Re: [saag] Channel binding is great but not a silver bullet

[Nicolas Williams <[e-mail]>]

On Mon, Mar 02, 2009 at 12:08:45PM -0500, Jeffrey Hutzelman wrote:
> --On Monday, March 02, 2009 10:00:36 AM -0600 Nicolas Williams 
> <[e-mail]> wrote:
> >Yes, but if we solve the mutual authentication case then for the cases
> >where we don't need mutual authentication we can probably live with a
> >weak PKI.
> 
> No, that is not true.  These days, people routinely establish new, real 
> business relationships online.  Companies like Amazon and PayPal depend on 
> this model, and so do smaller merchants who probably number in the 
> millions.  In many cases, consumers engage in a single transaction with 
> such a merchant and there is _never_ any enrollment.
> 
> Mutual authentication plus channel binding is a great model for some 
> things, but expecting to use off-line enrollment for everything forever is 
> a non-starter.

I addressed enrolment in separate posts.  I believe enrolment can be
bootstrapped securely in a great many ways.  For example:

 - via SMS (requires a phone)
 - via telephone (requires a phone)

 - at any network access point if you can authenticate the access point:

   Imagine a coffee house that posts a certificate fingerprint on a
   flyer by the cashier, then you can use the coffee house's
   infrastructure (an access point and a small service running on it) to
   enrol in any service federated with that coffee house.

   This method has anonymity.  It is a form of off-line enrolment in
   that it requires finding such a coffee house and going there, but we
   all pretty much do that -- we're physical beings after all and most
   of us go places (and even those that can't go places can still, with
   the help of others, do enrolment).

Note again that channel binding is but a means to an end -- if TLS were
to provide suitable mutual authentication mechanisms then we'd not need
channel binding as that would be but an internal detail of TLS.  Sadly
TLS does not (no, TLS-PSK is not a suitable mutual authentication
mechanism, for reasons I set out in a reply to Peter just now).

Nico
--