Re: Pub/priv key security

From: Anne & Lynn Wheeler (lynn_at_garlic.com)
Date: 12/09/03 

Date: Tue, 09 Dec 2003 13:16:00 GMT

"lyal" <lyalc@spam.ozemail.com.au> writes:
> their respective software modules) must both trust the same public
> keys. Exchanging public keys is as costly and complex as sharing a
> secret - and often far more expensive.

but mitigates the human factor problem with having to remember scores
of different shared secrets. also two-factor authentication makes it
somewhat more difficult for phishing & social engineering
vulnerabilities.

the substition of public key registeration for a pin/password
registration needs to be no more expensive and use the same exact
business process ... aka
http://www.garlic.com/~lynn/index.html#aads
say in either a straight-forward radius scenario where public key
is registered instead of pin/password:
http://www.garlic.com/~lynn/subpubkey.html#radius
or a kerberos pk-init scenario where public key is registered
instead of pin/password:
http://www.garlic.com/~lynn/subpubkey.html#kerberos

or even the SSH public key scenario.

The big cost issue for public key comes when there is an attempt to
create a major change in the business processes and trust model with a
PKI build-out. There seems to have been some PKI implicit assumption
that if the trust model and business processes change over could be
done on massive enough scale ... that all the PKI costs would
eventually be recouped thru scale of operations (i.e. loose $100 on
every unit but make up for it in volume). 

-- 
Anne & Lynn Wheeler | http://www.garlic.com/~lynn/ 
Internet trivia 20th anv http://www.garlic.com/~lynn/rfcietff.htm

Relevant Pages