Re: [Tigress] threat model review

[Daniel Kahn Gillmor <[e-mail]>]

Thanks for this further clarification, Yogesh.

Since we seem to be struggling with terms and definitions in this
thread, i'll ask a few more questions, as i'm still strugging with a
clear picture of the goals of this project.  I apologize if these are
already well understood here.

On Fri 2023-04-14 18:16:19 -0700, Yogesh Karandikar wrote:
> Digital Credential is defined in the requirements document as:
> Cryptographic material and other data used to authenticate the user
> with an access point

Do you mean "authenticate" or "authorize"?  Authentication is about
identity.  Authorization is about access.

The last time i checked into a hotel (they authenticated me at the
desk), i was given two RFID cards that were authorized to access (by
elevator) the floor of the hotel that the room was on, and the room
itself.

Had I handed one of those cards to someone else, i would have been
granting them *authorized* access without an *authenticating*
credential.  Just to make sure i'm understanding the terms right: the
"access point" is the elevator or the door in this case, right?

In my hotel, neither the elevator nor the door knows the identity of the
cardholder when i transfer the card to someone else.

If we explicitly define the credential transfer process as a process
that authenticates the recipient to the access point, that appears to
fix semantics in the protocol that would foreclose a common current
practice.

Is that intentional?

> As we discussed in the other email, it would be good to have common
> terminology across charter and all the documents.

Agreed.

> - Bob’s device needs to trust the url as a credential transfer url.

The word "trust" is a tricky one in this space, and common use of the
word is sometimes subtly opposed to the technical meaning.

It might help to be a little bit clearer here.  Which of these do you mean?

 a) Bob's device needs to be able to reliably assess whether the URL that
    initiates the Tigress process is in fact a credential transfer URL

 b) Bob's device must assume that the URL that initiates the Tigress process is
    a credential transfer URL, and he learns this in some unspecified
    out-of-band way; the protocol offers no way for him to prove it
    that it is correct.

(a) is i think closest to the "normal english" use of the term "trust".

(b) is the technical/security engineer use of the term "trust", as in
"trusted third party" or "trusted computing base".


Thinking about these questions also raises some additional concerns
about how TIGRESS plays with the rest of the ecosystem: Does Bob's
device needs to be able to reliably identify *in any non-TIGRESS
context* that the URLs seen are *not* credential transfer URLs?

Risky "magic URLs" in unexpected contexts can be seen, for example, in
the forwarded-bulk-email case:  Charlie receives a bulk e-mail that she
thinks Dave would be interested in, which has some links in it that she
doesn't know are unique to her (e.g. an unsubscribe link).  She forwards
the message without thinking to Dave, and Dave can then unsubscribe
Charlie from the distribution list.  Does TIGRESS need to consider this
scenario?

> - Bob’s device needs to know what type of credential is being
> transferred and if it supports that credential. If it does, which
> service or application (Car Key, Hotel Key, Apartment Key) should
> handle this credential transfer. Then fire up the right handler to
> complete the transfer.

What level of granularity do you imagine Tigress specifying here?
Should we be thinking about registering a new namespace that is
initially populated with generic classes like Car, Hotel, Apartment? or
is this more of a "each vendor is going to register their own "type", so
Bob can distinguish between, say, a Schlage or a Yale lock, or a Hyundai
from a Honda?

Are you envisioning a generic "unlocker" app (or OS utility) that can
use this protocol, or will i need to install distinct apps for my home
and my car, and then yet another new app for my friend's house when i
stay over, and a fourth one for the times when i drive my parent's car?

      --dkg