Re: [saag] SHA-1 to SHA-n transition

[Nicolas Williams <[e-mail]>]

On Thu, Feb 26, 2009 at 06:23:59PM -0800, Eric Rescorla wrote:
> I don't want to get into an extensive argument about this on SAAG,
> but I don't think this direction is particularly promising, for
> reasons I've indicated before: namely that you're handwaving
> the difficult part of the problem, UI, which we have no real 
> idea how to solve. Sure, if we solved that, there are any
> number of things we could do, but absent that, the other things
> are fairly useless.

I'm not entirely handwaving the UI part.  There are two major UI
problems: a) the desire for full-screen apps, and, more generally, apps
that have full access to human interface I/O, b) the desire of web
application developers to have full control over credentials prompts.

(a) is practically insurmountable -- SAS helps, but I doubt users will
be happy to use SAS every time they are prompted for credentials.  My
knee-jerk reaction would be to reject full-screen apps.

In my scheme (b) is solved by letting apps prompt for identities,
but not any passwords -- and training users not to enter passwords into
non-secure dialogs (see SAS comment) -- and by having authentication
mechanisms where the relying party does not get to impersonate the
client just because the client authenticated itself (this, in turn,
creates another problem in that lots of web services need delegation).

In particular I think the solution to (b) needs to go hand-in-hand with
any solution to the mutual authentication problem.

> I think you're rather overselling here: this only works well for
> account-based systems. There are plenty of cases where I need to
> connect to someone where I only know their name but I don't yet have
> an account (e.g., https://www.amazon.com). The mechanism that you
> provide doesn't work at all in this case. Rather, you need some
> third-party verifiable mechanism. I suppose one could argue that certs
> aren't a good such mechanism, but they're the one that TLS supports
> and I suspect any replacement would smell a lot like certs.

I just addressed enrolment (I took "but I don't _yet_ have an account"
to refer to enrolment) in a reply to Sam.

For cases that are not enrolment and where you never need user
authentication, but do need server authentication, I can only think of
PKI, and today's weak PKI will just have to do.

Nico
--