Re: New Method for Authenticated Public Key Exchange without Digital Certificates

From: Anne & Lynn Wheeler (lynn_at_garlic.com)
Date: 08/08/04


Date: Sat, 07 Aug 2004 17:38:59 -0600

Mok-Kong Shen <mok-kong.shen@t-online.de> writes:
> As said previously, you (thanfully but unnecessarily) gives
> too much infomrtions for my question(s). To repeat, what I
> claimed is that there must be some institution (no matter what
> its name actually is) that enjoys the trust of common people
> (hence in this sense 'autoritative') and testifies the
> correctness of certain essential information which assures
> (directly or indirectly) the security of the user transactions
> involved. That 'testifying' from it may not necessarily be
> directed to the end user, I suppose. But anyway, some
> 'certificates' (in some form) are issued by that 'authority'
> such that the whole system functions in practice. In this sense
> one needs some 'certifying authority' (whatever it is called
> actually).

which i intepret to mean that you have totally changed the context and
meaning of the original subject matter and extended it to imply that
you are referring to any situation where there might be some trust
agency that is somehow responsible for the integrity of some
information.

within that context ... you are changing the topic thread to a
theoritical discussion of any type of theoritical agency that might
possibly be in a responsible or trust position and potentially
responsible for the integrity or validity of any kind of arbritrary
information.

in this theoritical context ... apparently completely divorced from
and possibly having absolutely nothing to do with public key
technology, what are the possible meanings of trust and certifying?

well, resorting again to the merged security taxonomy and glossary
at
http://www.garlic.com/~lynn/index.html#glosnote

I find the possible following definitions that might possible be
of some use ... unfortunately there are generic definitions as well
as definitions specifically within the context of a Public Key, Digital
Certificate, Certification Authority environment.

note in the following more general definitions ... there are some that
are still PKI specific ... and potentially can be considered
ambiguous.

for instance in the attached trust definition .... is the "certificate
user" referring to the

a) public key owner .... which has a direct trust relationship with a
certification authority ... since the public key owner directly
interacted with the certification authority in obtaining the
certificate

b) the relying party ... which is the entity that is relying on the
information contained in a public key certificate ... and in many of
the TTP certification authority scenarios involve the relying party
having absolutely no relationship at all with the CA ... and therefor
it is difficult to demonstrate a relying party trusting a CA ... a
situation where there is likely to be no direct relationship.

but i apparently digress to the original subject that is PKI specific
... when you are attempting to address the trust and certify topic
totally divorced from any PKI related context.

certification

(1) Comprehensive evaluation of the technical and nontechnical
security features of an AIS and other safeguards, made in support of
the approval/accreditation process, to establish the extent to which a
particular design and implementation meet a set of specified security
requirements. Note: There remain two other definitions in active
common usage that differ according to circumstances. (2) The issue of
a formal statement confirming the results of an evaluation, and that
the evaluation criteria used were correctly applied. Synonym for IT
security certification. [AJP] (I) Information system usage: Technical
evaluation (usually made in support of an accreditation action) of an
information system's security features and other safeguards to
establish the extent to which the system's design and implementation
meet specified security requirements. (I) Digital certificate usage:
The act or process of vouching for the truth and accuracy of the
binding between data items in a certificate. (I) Public key usage: The
act or process of vouching for the ownership of a public key by
issuing a public-key certificate that binds the key to the name of the
entity that possesses the matching private key. In addition to binding
a key to a name, a public-key certificate may bind those items to
other restrictive or explanatory data items. (O) SET usage: 'The
process of ascertaining that a set of requirements or criteria has
been fulfilled and attesting to that fact to others, usually with some
written instrument. A system that has been inspected and evaluated as
fully compliant with the SET protocol by duly authorized parties and
process would be said to have been certified compliant.' [RFC2828]
Comprehensive evaluation of the technical and nontechnical security
features of an AIS and other safeguards, made in support of the
accreditation process, to establish the extent to which a particular
design and implementation meets a set of specified security
requirements. [FCv1] Procedure by which a third party gives written
assurance that a deliverable (product, system or service) conforms to
specified requirements. [SC27] The administrative act of approving a
computer system for use in a particular application. [SRV] The
comprehensive evaluation of the technical and non-technical security
controls of an IT system to support the accreditation process that
establishes the extent to which a particular design and implementation
meets a set of specified security requirements. [800-37] The
comprehensive evaluation of the technical and nontechnical security
features of an AIS and other safeguards, made in support of the
accreditation process, that establishes the extent to which a
particular design and implementation meet a specified set of security
requirements. [NCSC/TG004][OVT] The issue of a formal statement
confirming the results of an evaluation, and that the evaluation
criteria used were correctly applied. [ITSEC] The technical evaluation
of a system's security features, made as part of and in support of the
approval/accreditation process, that establishes the extent to which a
particular system's design and implementation meet a set of specified
security requirements. [TCSEC][TNI]

certify (unfortunately is specific to the PKI environment):

(I) Issue a digital certificate and thus vouch for the truth,
accuracy, and binding between data items in the certificate, such as
the identity of the certificate's subject and the ownership of a
public key. (C) To 'certify a public key' means to issue a public-key
certificate that vouches for the binding between the certificate's
subject and the key. (I) The act by which a CA employs measures to
verify the truth, accuracy, and binding between data items in a
digital certificate. (C) A description of the measures used for
verification should be included in the CA's CPS. [RFC2828]

trust

(I) Information system usage: The extent to which someone who relies
on a system can have confidence that the system meets its
specifications, i.e., that the system does what it claims to do and
does not perform unwanted functions. (C) 'trusted vs. trustworthy': In
discussing a system or system process or object, this Glossary (and
industry usage) prefers the term 'trusted' to describe a system that
operates as expected, according to design and policy. When the trust
can also be guaranteed in some convincing way, such as through formal
analysis or code review, the system is termed 'trustworthy'; this
differs from the ABA Guidelines definition. (I) PKI usage: A
relationship between a certificate user and a CA in which the user
acts according to the assumption that the CA creates only valid
digital certificates. (O) 'Generally, an entity can be said to 'trust'
a second entity when it (the first entity) makes the assumption that
the second entity will behave exactly as the first entity
expects. This trust may apply only for some specific function. The key
role of trust in [X.509] is to describe the relationship between an
entity and a authority; an entity shall be certain that it can trust
the certification authority to create only valid and reliable
certificates.' [RFC2828]

-- 
Anne & Lynn Wheeler | http://www.garlic.com/~lynn/


Relevant Pages

  • Re: Two-factor authentication with SSH?
    ... > As a system administrator I am responsible for the security and the ... > the passphrase from his certificate. ... > password authentication on the server side. ... There has to be some process that registers the public key ... ...
    (comp.security.ssh)
  • Re: Creating a root CA to encrypt mail
    ... The other way is using the Certificate Assistant. ... You don't need another keychain for the keys and certificates. ... CAs certificate you have to set it to allways trust, ... you need the public key of the recipent in your ...
    (comp.sys.mac.system)
  • Re: New Method for Authenticated Public Key Exchange without Digital Certificates
    ... resorting again to the merged security taxonomy and glossary ... > as definitions specifically within the context of a Public Key, ... > Certificate, Certification Authority environment. ... > Comprehensive evaluation of the technical and nontechnical ...
    (sci.crypt)
  • Re: SSL certificates
    ... The public key is, ... > the server certificate itself is created. ... integrity problems with the domain name infrastructure). ... note however there is supposedly a "chain of trust" ... ...
    (sci.crypt)
  • Re: Certificates Q
    ... at the certificate, the subject's public key field shows ... It basically comes down to PR, the security community has more or less ... Firefox chooses a different view, ... "Subject Public Key Info:" ...
    (sci.crypt)