[POSH] a POSH-ian play

[Peter Saint-Andre <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Here is a light-hearted attempt to better explain the need for
something like POSH...

###

A POSH-ian Play

Dramatis Personae

Alice, an employee of Company A
Bob, an employee of Company B
Company A
Company B
CA, a Certification Authority
Host, a Hosting Provider

ACT ONE: The Perils of PKI

SCENE 1 - No Shirt, No Service

HOST to CA: Hey, I need a certificate.
CA: Sure thing, for which domain?
HOST: It's company-a.com.
CA: Great, I'll send an email to [e-mail].
HOST: Um, actually, that won't work.
CA: Why not?
HOST: Well, I don't control that address.
CA: No problem, just prove that you're Company A in some other way.
HOST: Sorry, I can't do that.
CA: Why not?
HOST: Well, I'm just their hosting provider.
CA: Sorry, then I can't give you a cert for company-a.com.
HOST: That's a bummer.
CA: But I can give you a cert for hosting.example.net.
HOST: I already have one of those!
CA: So why not just use it?
HOST: I guess I'll have to, thanks.

SCENE 2 - Trust Me!

ALICE to COMPANY A: I'd like a secure Foo connection, please.
HOST: Sure, here's my certificate.
ALICE: Who are you?!
HOST: I'm the hosting provider for company-a.com.
ALICE: Yeah, right!
HOST: No, really, you can trust me!
ALICE: Forget it, you scammer. I'm out of here!

SCENE 3 - Reassurance

ALICE to COMPANY A: I had a scary experience today!
COMPANY A: I'm sorry to hear it. What happened?
ALICE: I tried to connect and this Host said they were you!
COMPANY A: Which Host?
ALICE: Here's the certificate they presented...
COMPANY A: Oh, actually that's fine.
ALICE: Really??
COMPANY A: Yes, we hired them to host our Foo service.
ALICE: Oh, OK. So what should I do next time?
COMPANY A: Just click "OK".
ALICE: That doesn't seem very secure!
COMPANY A: Well, check that the cert says "hosting.example.net".
ALICE: OK, but only if you say so...

SCENE 4 - Failed Communication

ALICE to COMPANY A: I'd like a secure Foo connection, please.
HOST: Sure, here's my certificate.
ALICE: Hmm, this says you are hosting.example.net.
HOST: Right, that's me.
ALICE: Um, I'm still not really comfortable, but OK.
HOST: Great, here's your secure connection.
ALICE to HOST: I'd like to send a message to Bob, please.
HOST: Coming right up!
COMPANY A to COMPANY B: Here's a message for Bob.
COMPANY B to COMPANY A: Hold on, let me verify your identity.
HOST: Sure, here's my certificate.
COMPANY B: Who are you?!
HOST: I'm the hosting provider for company-a.com.
COMPANY B: Yeah, right!
HOST: No, really, you can trust me!
COMPANY B: Forget it, you scammer. I'm out of here!
HOST to ALICE: Sorry, I can't deliver your message.
ALICE: Why not?
HOST: Company B didn't believe that I'm the host for Company A.
ALICE: See, I told you so! So how do I contact Bob?
HOST: I suppose you could call him on the phone...
ALICE: That kind of defeats the purpose of this Foo service, eh?
HOST: No comment.

ACT TWO: The Pleasures of POSH

SCENE 1 - The Delegation Dance

COMPANY A to HOST: This isn't working out.
HOST: What do you mean? We get along great.
COMPANY A: Alice can't talk to Bob.
HOST: Yeah, I know.
COMPANY A: What are you going to do about it?
HOST: Well, we could try something new.
COMPANY A: I'm all ears.
HOST: Here, put this file on your webserver.
COMPANY A: What's in the file?
HOST: It tells Company B about the certificate for the Foo service.
COMPANY A: Isn't this your certificate?
HOST: Yes, but that means I don't need your private key.
COMPANY A: That sounds good. I trust you, but not *that* much.
HOST: Um, OK.
COMPANY A: Where do I put the file?
HOST: At https://company-a.com/.well-known/posh-foo.json
COMPANY A: OK, I'll give it a try.
HOST: Oh, and make sure it's served only over HTTPS!
COMPANY A: Done.
HOST: Thanks, let's see how this works...

SCENE 2 - Success

ALICE: https://company-a.com/.well-known/posh-foo.json please.
COMPANY A: Here's the JSON Web Key set you requested.
ALICE: Thanks! Now I'd like a secure Foo connection, please.
HOST: Sure, here's my certificate.
ALICE: Hey, that matches the JWK set. Cool!
HOST: Yes, it's this fancy new POSH technology we're using.
ALICE: It's posh indeed! You're very smart.
HOST: Aw, shucks.
ALICE to HOST: I'd like to send a message to Bob, please.
HOST: Coming right up!
COMPANY A to COMPANY B: Here's a message for Bob.
COMPANY B: https://company-a.com/.well-known/posh-foo.json please.
COMPANY A: Here's the JSON Web Key set you requested.
COMPANY B: Thanks. I'd like a secure Foo connection, please.
HOST: Sure, here's my certificate.
COMPANY B: Great, that matches the JWK set I got at Company A.
HOST: POSH in action.
COMPANY B: Yep. You're good to go. I'll send that message to Bob.
HOST: I appreciate it!
COMPANY B to BOB: Here's a message from Alice.
BOB: Excellent, I've been waiting for that. Here's my reply.
COMPANY B to HOST: Please send this message to Alice.
HOST to COMPANY B: Got it! I'll send that right along.
HOST to ALICE: Here's a message from Bob.
ALICE: Thanks. It seems that we have a happy ending after all.
HOST: Thanks to POSH, you bet!

THE END

###

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJSDUD/AAoJEOoGpJErxa2p2EgP/js5f1DGdzREJ3prmJA8QIE0
7GArKlqTPsDduhzfdywEm1BqZWe2J/sCw0yHlvYX5ibaMmwOVyW9B9Bizd+NgMKB
i01HKVaKx+rp4OOuyiGROw0047cpNNh/TEId4mbuz3tVksC1wyWxKFgfLHi64neb
979ci/LpD1/Knbrz2OWax5d+uYfPnXjb2heyfiU02P7eXQGGKDxD5p+E9QJOqS0h
8x3EvA8CpJ3+prwsXkqVYGpSvv7Ijf5UEF5IwkijMW6J3zQBndqlCouCNC/6Juro
BC08cezG93oa11VOpX+929Pr2b1US098CLp4/DS9QPfdd+79uUS8xYA3TMRNiWUk
ZD1JgwWbrFkBpip7Vb3xrpFkuG5EBLZOobXZx2g4vQivVu4nD1FBMi/KnfTLQK45
JBg+nFb/IAWZNU0sgWkiP5FlKk58CDh1Cw/KqT1REAPVJEj3vhAbG68PX5rroT5h
jf7oEYut5lqHOZs67HnwGxKOrwnKVQXp8O6+Xa8psJzihU3frnlYhZbNv65MYbpJ
y+PxwnaxDBjZmNJmmUM2Bnof3BaZgPZD5snOWOTXX9jWtGwyTV4SbPCtkdfaLl/l
i8tj/JAYC/sxnFY2lG+xOUUi63dD8ALUeSFnm9rIl7jfSRiWwhJ7H/sWSefvdWvB
UPd9VELBLabXdErxCrk+
=f8BX
-----END PGP SIGNATURE-----