Re: [saag] post-X509 cryptographic identities

[Phillip Hallam-Baker <[e-mail]>]

Sorry for the driveby. Due to current circumstances it is difficult for me
to read. So I could only take in the first dozen or so posts.

The origin of PKIX is to be found in Kohnfelder's Msc thesis at MIT. It
describes CAs, CRLs and the directory. It is essentially X.509v1. The big
weakness in that work is that the set of constraints it is designed to
address no longer exist. Today network connectivity is
essentially ubiquitous, back then it was rare.

PKI is a combination of three principle elements

1) Structure
2) Ceremony
3) Syntax

Naming is a consequence of structure. In X.509, trust flows down from the
root node of the directory. PKIX then subverts this entirely by grafting on
a completely separate naming structure via SANs. So the X.509 naming
infrastructure is essentially inconsequential.

The big difference between DNSSEC and PKIX is that in DNSSEC the naming
system and the structure of trust are the same. Which is one of the reasons
DNSSEC doesn't really meet modern trust needs.

SPKI is not quite so dead as people imagine. Brian LaMacchia applied many
of the concepts in the Strong Naming infrastructure in .NET. But the
approach is ultimately solipsistic.

The approach I tried to take in Shen in the 90s and have revisited with the
Mesh is to make every individual the apex of their own trust hierarchy. My
original hope was we could do something of the sort with PKIX. But X.509 is
simply too complex for most organizations to manage let alone individuals.

DNSSEC cannot meet my security needs because it insists all trust flows
from one point. If I am designing an embedded system, I want to be able to
specify the roots of trust.


Ceremony is a topic Carl Ellison introduced. If you want to understand the
security of the system, you have to understand more than just the protocol
and the math. If you want to understand a PGP key signing, you need to
understand it as ceremony.

IETF has ignored ceremony for too long under the motto 'we don't do UI'.
Well you have to do ceremony to do security. So its about time we changed
that. I am currently working (or trying to) on a paper on onboarding
ceremonies which I hope will show the point.


Syntax is the least important part of PKI but it is a part of the puzzle.
Why oh why do people think canonicalization is relevant? If you want to be
able to verify a signature, you have to keep the original bits that were
signed. End of story.

That said, XML is better than ASN.1 DER because it isn't completely stupid.
JSON is better as a data serialization than XML because it is designed to
be a data serialization not a document markup. Requiring elements be
presented in a particular order and schema validation are bogus.