Re: [TLS] Root certificates in server certificate chains

["Blumenthal, Uri - 0668 - MITLL" <[e-mail]>]

Probability (greater than 1/2^80) comes into play when you need to make a decision based on incomplete information - and responses like "call back when you have your form DD-xxxx and token YYY in hand, until then take a hike" are not acceptable.

Re. How can an unattended system know - by the virtue and power of flexible dynamic and complex policy that takes these aspects into consideration. The required complexity of such policies is one reason they now exist mostly in theory. I personally think such complex policies are inevitable, but their time (and our ability to deal with them) hasn't come yet. In fact we still have problems with simplistic policies. 

We can discuss home-grown CA offline if you wish. 

--
Regards,
Uri

----- Original Message -----
From: Marsh Ray [mailto:[e-mail]]
Sent: Tuesday, August 31, 2010 10:42 PM
To: Blumenthal, Uri - 0668 - MITLL
Cc: '[e-mail]' <[e-mail]>
Subject: Re: [TLS] Root certificates in server certificate chains

On 08/31/2010 09:15 PM, Blumenthal, Uri - 0668 - MITLL wrote:
> Sending root cert makes sense for Trust model based on computed
> probabilities - which does not exist today except in research
> papers.

IMHO introducing into a secure protocol discussion any probability 
greater than about 1/2^80 represents a dangerous logical fallacy.

Attacks are not statistical like meteor strikes and earthquakes.

Attackers are real smart people in practice. The attacker controls many 
of the variables of your system and likely is is more comfortable 
operating in its corner cases and failure modes than the legitimate 
parties are.

> The idea is - you verify as much as practical, and decide how much
> you trust the requester regarding his request.

How does that work for unattended systems that need to authenticate one 
another? How does can the system possibly know how many dependencies 
will be built upon the secure authenticated channel it establishes? Can 
the designer know this? Can even the user?

> E.g. consider two questions: "can I use your phone?" and "can I use
> your car?"

Either one could be used to rob a bank or make a drug deal and I could 
end up answering some difficult questions from the police. In practice, 
I am required by law to insure the car because eventual disaster is a 
near statistical certainty. Also in practice, big-time crime is 
committed over phones.

> Oh, and the current trust model has little room for root cert as a
> part of the transmitted chain. Although - a home-grown CA, a bunch of
> pals establishing a  TLS-protected Web chat site...? No need to get
> VeriSign involved... Why not?

Because everyone who accepts the home-grown CA becomes silently 
vulnerable to having their online banking credentials stolen when it 
turns out that the home-grown CA wasn't being professionally maintained 
after all:

http://www.google.com/search?hl=en&q=%22begin+rsa+private+key%22+site%3Apastebin.com

- Marsh