Subject: [perpass] The problem with scaling authentication...

From: Richard Barnes <[email-masked]>
Date: Mon, 25 Nov 2013 10:02:23 -0500

... is that the authorities can make bad decisions.

The Economist has an article this week about suspect passport issuance
practices among a collection of Caribbean nations.  For example, an
official in Suriname simultaneously serving as counter-terrorism official
and issuing false passports to Hezbollah.  Or several countries that now
allow "economic citizenship" for a few 100k$.

Just wanted to observe that authentication woes are not unique to the
Internet and its collection of CAs.  Authenticating things on a global
basis is hard.

<
http://www.economist.com/news/americas/21590574-murky-world-bouterses-passports-ignominy

---

From: SM <[email-masked]>
Date: Mon, 25 Nov 2013 09:42:59 -0800

Hi Richard,
>... is that the authorities can make bad decisions.

[snip]

>Just wanted to observe that authentication woes are not unique to 
>the Internet and its collection of CAs.  Authenticating things on a 
>global basis is hard.

There is a significant number of examples of bad decisions.  I'd say 
that proof of possession was not used as much in the non-Internet world.

Regards,
-sm

---

From: Stephen Kent <[email-masked]>
Date: Mon, 25 Nov 2013 15:14:29 -0500

> that proof of possession was not used as much in the non-Internet world.
I'm puzzled by your last comment. In the PKI context, the phrase "proof 
of possession"
(PoP) refers to a mechanism used to verify that a subject requesting a 
cert possesses the
private key corresponding to the public key in the cert request.

When an entity receives a cert containing Subject name (or Subject alt name)
that is not appropriately associated with the entity, that is NOT a failure
of PoP. The entity presumably does possess the corresponding private key,
since it can't complete a TLS exchange without it.

Steve

---

From: SM <[email-masked]>
Date: Mon, 25 Nov 2013 13:42:20 -0800

Hi Steve,
At 12:14 25-11-2013, Stephen Kent wrote:
>I'm puzzled by your last comment. In the PKI context, the phrase 
>"proof of possession"
>(PoP) refers to a mechanism used to verify that a subject requesting 
>a cert possesses the

I wasn't thinking about failure of PoP or PKI.  Your message reminded 
me that I didn't think about some real world details when I made that comment.

Regards,
-sm

P.S. I was thinking about how often passports were used.