Re: [saag] Channel binding is great but not a silver bullet

[Nicolas Williams <[e-mail]>]

On Thu, Feb 26, 2009 at 03:20:06PM -0500, Sam Hartman wrote:
> Nico, while I'm in favor of channel binding and believe your approach
> has a lot of value, please be careful to apply it only where applicable.

I'm mildly offended by your comment.  This is not channel binding as an
end -- it'd be silly to treat channel binding as end in itself, and if
you imply that that's what I'm doing then I categorically reject that.

This is channel binding as a means to an end, not as the end.  The end
is mutual authentication without a PKI but with [optional] federation.

> Phil is talking about the web browser PKI.  Channel binding to
> existing authentication solves some problems in that space, but
> definitely not all.  For example it is not useful for securing
> enrollment or certain classes of URI-only handoff.

My proposal does not solve enrolment, and though enrolment is the same
problem as the base problem, enrolment is also rare, therefore a simpler
problem.

There are two kinds of enrolment: those where the user is willing to use
a pre-existing business relationship, and those where the user is not.
For the former one could use SMS, much the way Google handles gmail
account creation, and, with somewhat less privacy, any ISP-mediated
federation will do as well -- heck, one could have coffee-house mediated
federation.  For the latter the existing weak PKI will just have to do,
but arguably if you're signing up for a hotmail or gmail account without
a pre-existing relationship then you get what you pay for, and anyways,
eventually you'll notice if you've enrolled through an MITM (because the
MITM won't always be able to be in the middle!).

> So, I think the web will continue to need a PKI.:-)

Yes, but if we solve the mutual authentication case then for the cases
where we don't need mutual authentication we can probably live with a
weak PKI.

Nico
--