Re: WG Last Call on draft-ietf-pkix-tac-03

[Stephen Kent <[e-mail]>]

Re: WG Last Call on draft-ietf-pkix-tac-03

At 2:56 PM +0100 4/2/09, Stephen Farrell wrote:

Stefan Santesson wrote:
> The authors of Traceable Anonymous Certificate
> draft-ietf-pkix-tac-03.txt has requested WGLC.
>
> http://tools.ietf.org/html/draft-ietf-pkix-tac-03
>

A couple of comments:

#1: Top of p7:
  "To effect issuance of the TAC, the AI interacts with
   the BI, over a secure channel, to jointly create the signature on
   the TAC, and sends the signed TAC to the user.

   The AI does this without learning the user's real identity
   (either from the user or from the BI)."

If the AI sends the TAC to the user, then it will know some
form of identity for that user, even if that's only an IP
address. (And with the likes of SAVI, that could well be

enough to establish a real identity.)

We already note in the Security Considerations section that the anonymity guarantees offered by the TAC model may be undermined by lower layer protocol info of this sort.

   It also may be possible to determine the identity of a user via information

   carried by lower level protocols, or by other, application-specific means. 

   For example, the IP address of the user might be used to identify him/her.

So, this is not a new concern and I think it is adequately addressed by the current Security Considerations text.

I'd have thought it'd be much better to return the TAC

via the BI and not require any user<->AI direct connections?

The BI knows the user's true identity, but is not supposed to know the ID that appears in the Subject field of the TAC (or the rest of the cert content). So, the BI cannot hand the cert back to the user in plaintext form.

#2: Section 5.2 claims that the AI can't unilaterally fool
the BI into revealing the real identity. But the only thing
that stops that seems to be the RP client identity verified
by the BI when the RP establishes a mutual-auth TLS connection
to the BI.

So how can the BI really know that its not the AI making that

connection?

Yes, it is the two-way authenticated TLS connection via which the identity is revealed that is intended to prevent the AI from requesting the  user ID unilaterally. There is an assumption (that we can make explicit) that the cert issued to the RP (typically a web site) was issued by an independent CA, not affiliated with the TAC.

Steve