Subject: [saag] Alternative terminology to "certificate" or "credential"?

From: Dave Crocker <[email-masked]>
Date: Fri, 23 May 2014 07:07:08 -0700

Hi.

I'm looking for a term that refers to a package associating a key with
"other attributes" but which does not imply the usual Certificate
Authority trust model.

Rather, packaging things together is separate from statements of trust
about the package supplier or the contents of the package.

The bare word "certificate" might be theoretically reasonable, but
established usage means people will typically assume it invokes the
usual CA model.

The only candidate term I've come across is 'credential', but my own
impression matches that of Wikipedia:

   http://en.wikipedia.org/wiki/Digital_credential

   "Because of the still evolving, and sometimes conflicting,
   terminologies used in the fields of computer science, computer
   security, and cryptography, the term "digital credential" is used
   quite confusingly in these fields"

Any suggestions?

Thanks.

d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 23 May 2014 10:16:24 -0400

> I'm looking for a term that refers to a package associating a key with "other attributes" but which does not imply the usual Certificate Authority trust model.

SAML uses the term "assertions," which seems a good fit.

	/r$

--  
Principal Security Engineer
Akamai Technologies, Cambridge, MA
IM: [email-masked]; Twitter: RichSalz

---

From: "Walker, Jesse" <[email-masked]>
Date: Fri, 23 May 2014 14:17:54 +0000

A word we use in the industry for this function is "manifest". A manifest is a signed collection of attributes, one usually being the hash of the data to which the manifest refers (often an executable image).

> -----Original Message-----
> From: saag [mailto:[email-masked]] On Behalf Of Dave Crocker
> Sent: Friday, May 23, 2014 7:07 AM
> To: [email-masked]
> Subject: [saag] Alternative terminology to "certificate" or "credential"?
> 
> 
> Hi.
> 
> I'm looking for a term that refers to a package associating a key with "other
> attributes" but which does not imply the usual Certificate Authority trust model.
> 
> Rather, packaging things together is separate from statements of trust about
> the package supplier or the contents of the package.
> 
> The bare word "certificate" might be theoretically reasonable, but established
> usage means people will typically assume it invokes the usual CA model.
> 
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag

---

From: Nico Williams <[email-masked]>
Date: Fri, 23 May 2014 10:49:29 -0500

> impression matches that of Wikipedia:

Credential is what we use in the GSS-API.  It's the most generic term
we have for "something that can be used to authenticate to another
party".

All the other terms in use for this are mechanism-specific:

 - certificate -> PKIX (and others, like Persona)
 - ticket -> Kerberos (and others, like TLS resumption)
 - assertion -> SAML
...

The main downside of "credential" is that for many people it means
"password" or "something to use to get a {certificate, ticket,
assertion, ...} with".

But I don't think that looking yet another new term is the right way
forward: that's how we end up with glossaries bloated with near
synonyms.  New terminology where existing one will do... just creates
a barrier to entry, and had better be strongly justified (e.g., it
really solves a problem).

Nico
--

---

From: Nico Williams <[email-masked]>
Date: Fri, 23 May 2014 10:49:40 -0500

> A word we use in the industry for this function is "manifest". A manifest is a signed collection of attributes, one usually being the hash of the data to which the manifest refers (often an executa…

I've never heard that used in a context where "credential" would also
have worked.  I don't think it generalizes as well as "credential"
either (e.g., calling a Kerberos ticket a "manifest" just does not
seem to me to fit).

Nico
--

---

From: Dave Crocker <[email-masked]>
Date: Fri, 23 May 2014 09:02:06 -0700

> "password" or "something to use to get a {certificate, ticket,

The history of ambiguity for 'credential' seems pretty serious to me.
It's difficult -- actually, I believe impossible -- to get everyone to
adapt, once there's a long, problematic history.

So I'm looking for a term that is not tied to any existing services.  It
might apply to some, but would stand separate from them.

The world is possibly considering different models than what is
currently entrenched and I'd like to have a term that isn't tied to any
existing (and poorly adopted) mode.

> synonyms. 

Having no precise term for a distinctive use case makes it unlikely
people will properly attend to that case.

I have only just started using PGP.  I note that Thunderbird's module
asks me to rate the level of trust I have in the key.  I think this
matches the idea of a "level of assurance" step that is decoupled from
the semantics of the key-containing package -- where the latter is what
I'm looking for a label to describe.

This de-coupling of actual trust assessment from the packaging and
delivery mechanism for the key is exactly what I want to emphasize.

It's not that the package carries no implied trust.  It's that the trust
isn't institutionalized in the definition of the package, and that the
real trust assessment is an independent process.

My immediate reaction is that 'assertion' might work well, although
'manifest' sounds interesting...

d/

---

From: Nico Williams <[email-masked]>
Date: Fri, 23 May 2014 11:05:40 -0500

> existing (and poorly adopted) mode.

When I find myself having to deal with "credential"'s extreme
generality I qualify it.  E.g., "cryptographic credential" ==
{certificate, ticket, assertion, ...}, while "initial credential" ==
something to use in authenticating to a Kerberos AS, SACRED server,
IdP, ...

That's one thing I really like about credential: it's easy to modify
with an adjective or adjectival phrase.

Nico
--

---

From: Paul Lambert <[email-masked]>
Date: Fri, 23 May 2014 09:42:46 -0700

>"other attributes" but which does not imply the usual Certificate

To build more complicated and interesting trust models we do need
a new framework and terminology.  The relationships that we could
describe in a Œpackage¹ of information may or may not serve
the same functions that we currently describe as a credential.

I¹m partial to describing such constructs in terminology that could
be mapped to formal logical models or programming analogies.
Specifically, expressions of attribute bindings to a key are just
one type of Œstatement¹.  A Œsigned statement¹ would be a
certificate-like structure.

>about the package supplier or the contents of the package.

Yes - Œstatement of trust¹  is a nice term for a statement that
delegates a attribute range to a target/key.

Paul

---

From: Tim Bray <[email-masked]>
Date: Fri, 23 May 2014 11:56:34 -0500

In OpenID Connect, based on OAuth 2, they call the individual assertions in
a package “claims”, and the claims are packaged up in an “ID Token”.  It’s
all nice terminology, because “claim” is accurately descriptive, ”ID”
describes what the payload is, “Token” tells you that it's a thing you send
around the network, and none of those words carry connotations that are apt
to cause faulty preconceptions to set in.

So I suspect that you might do well to consciously avoid re-using
terminology that comes with well-established but probably-misleading
semantics.

On Fri, May 23, 2014 at 9:16 AM, Salz, Rich <[email-masked]> wrote:

> "other attributes" but which does not imply the usual Certificate Authority
> trust model.
>

-- 
- Tim Bray (If you’d like to send me a private message, see
https://keybase.io/timbray)

---

From: Nico Williams <[email-masked]>
Date: Fri, 23 May 2014 12:21:06 -0500

I would also point to the debate about "opportunistic X" as an example
of where we considered existing terminology carefully and settled on
reusing a bit of existing terminology for carefully considered reasons
(namely that "opportunistic" is too awesome and unique an
English-language adjective to pass it over for much lesser
alternatives).  That case is also an example of using a phrase instead
of a single word.

I strongly prefer "X credential", where X is an adjective like
"cryptographic".  "Credential" is too good a word to throw out on
account of past usage of it.

Nico
--

---

From: Dave Crocker <[email-masked]>
Date: Wed, 28 May 2014 11:13:31 -0700

On 5/23/2014 7:07 AM, Dave Crocker wrote:
> about the package supplier or the contents of the package

Many thanks to the folk who offered and discussed candidate vocabulary.

An ad hoc, separate (small-group) discussion yesterday developed
surprisingly strong rough consensus on a term:

     signet

It nicely has relevant natural-language semantics and no apparent
security area, term-of-art baggage.

d/

---

From: Henry B Hotz <[email-masked]>
Date: Thu, 29 May 2014 15:21:44 -0700

So the idea is that a SAML assertion, GSS credential, and X.509 certificate are all examples of a signet? I agree that the existing dictionary definition of the word is nice for the purpose (though I would have voted for Nico's suggestion).

> security area, term-of-art baggage.

Personal email.  [email-masked]

---

From: Dave Crocker <[email-masked]>
Date: Thu, 29 May 2014 16:47:34 -0700

On 5/29/2014 3:21 PM, Henry B Hotz wrote:
> So the idea is that a SAML assertion, GSS credential, and X.509
> certificate are all examples of a signet? I agree that the existing
> dictionary definition of the word is nice for the purpose (though I
> would have voted for Nico's suggestion).

Hmmm.  I hadn't thought of signet as being a superset of things like
X.509 certs.  I'd been thinking of it as an alternative.

But I suppose the definition I gave really is that generic.

d/