Re: [saag] post-X509 cryptographic identities

[Nico Williams <[e-mail]>]

On Fri, Feb 14, 2020 at 02:44:53PM -0500, Phillip Hallam-Baker wrote:
> The approach I tried to take in Shen in the 90s and have revisited with the
> Mesh is to make every individual the apex of their own trust hierarchy. [...]

Yes, but that way lies TOFU.  That's fine for many things, but not all
things.  You could argue the inverse is also true, that rooted naming
and trust are fine for many things, but not all things -- I would agree
with that.

>                                                                         My
> original hope was we could do something of the sort with PKIX. But X.509 is
> simply too complex for most organizations to manage let alone individuals.

I'm curious about this.  Are you referring here to the use of ASN.1/DER
and the ASN.1 types in RFC5280, or are you referring to semantics, or
something else?

> DNSSEC cannot meet my security needs because it insists all trust flows
> from one point. If I am designing an embedded system, I want to be able to
> specify the roots of trust.

Thanks for expanding on that.  I can agree with mesh-like trust and
naming for this, but for many things we'll still need a rooted trust
system like DNSSEC.

> IETF has ignored ceremony for too long under the motto 'we don't do UI'.
> Well you have to do ceremony to do security. So its about time we changed
> that. I am currently working (or trying to) on a paper on onboarding
> ceremonies which I hope will show the point.

+1

> Syntax is the least important part of PKI but it is a part of the puzzle.
> Why oh why do people think canonicalization is relevant? If you want to be
> able to verify a signature, you have to keep the original bits that were
> signed. End of story.

See below.

> That said, XML is better than ASN.1 DER because it isn't completely stupid.
> JSON is better as a data serialization than XML because it is designed to
> be a data serialization not a document markup. Requiring elements be
> presented in a particular order and schema validation are bogus.

BER/DER/CER, and all TLV ERs are idiotic, yes.  JSON is OK.  The rest of
what you say in this paragraph, not so much.

BTW, Heimdal's ASN.1 compiler lets you name types whose encodings have
to be saved in a `_save` structure field by the decoder.  It's very
nice, and, for PKIX, essential.  General purpose JSON decoders however
generally don't decode to a schema the way decoders compiled from an
ASN.1 module do, so it's harder to add a "save this part as encoded for
later signature verification" feature -- not impossible, but not widely
available either.  So one has to resort to base64-encoding the JSON
texts to be signed/encrypted and then sending those as strings in other
(possibly JSON) documents (e.g., JWT).  (In Kerberos we do the moral
equivalent and wrap things to be signed/encrypted in OCTET STRINGs.)

Nico
--