From nobody Thu Apr 2 10:46:55 2015 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 716081B2DA5 for ; Thu, 2 Apr 2015 10:46:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.422 X-Spam-Level: * X-Spam-Status: No, score=1.422 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9JmznAVmcF2A for ; Thu, 2 Apr 2015 10:46:51 -0700 (PDT) Received: from mail-lb0-x230.google.com (mail-lb0-x230.google.com [IPv6:2a00:1450:4010:c04::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06F4E1B2D94 for ; Thu, 2 Apr 2015 10:46:50 -0700 (PDT) Received: by lbbug6 with SMTP id ug6so64739455lbb.3 for ; Thu, 02 Apr 2015 10:46:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:date:message-id:subject:from:to:content-type; bh=vxm3m+xC9+QDFpaMG7+/53I5DvpeiQnHSCSZeBBre4g=; b=kvw23RA+uys9LrwWmurlxKaurYAZbMRnzaUAN5/3hiZU/iN1gMS3+mm7RtO5V1tQCH Ec6YPcYzPwFbIEmgmq3QAZ1v/1gGCfbcWh6kVA1U69/c248mk7u9rg0qd+5mTSStyT0/ zWVcKOX96rM3YB/hFFpQbrAMjDPsaWht+zKamCMrR7/zlCb/4r+SjsnhRngDa8BWwSjx oL+GVYmKv3htjBclM0cuZjFsi7wLtJyJkzuB+YfeN9b1tgrLlMc0oQwQFmSzFaixuepE hi074UoI1iamj2gH+BH9P67Wg6ZFAIBGgtLnZtW1FAtPHpreS4UPH7U3uGzPIyTwYiZC XOZQ== MIME-Version: 1.0 X-Received: by 10.152.171.5 with SMTP id aq5mr18804067lac.91.1427996808511; Thu, 02 Apr 2015 10:46:48 -0700 (PDT) Sender: hallam@gmail.com Received: by 10.112.147.165 with HTTP; Thu, 2 Apr 2015 10:46:48 -0700 (PDT) Date: Thu, 2 Apr 2015 13:46:48 -0400 X-Google-Sender-Auth: 83th_buq2rOQyTLlxIjXBCJyN_g Message-ID: From: Phillip Hallam-Baker To: "therightkey@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [therightkey] Principle of least privilege... X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2015 17:46:53 -0000 CNNIC is an opportunity to learn from mistakes. One conclusion I draw is that PKIX and OpenPGP have very different expectations of trust providers. We could express OpenPGP key signings as PKIX certificates but this would be a mistake. They are better understood to be 'endorsements' rather than 'certificates'. Another conclusion is that there is a lot of infrastructure in the PKIX world that should not be abandoned or ignored lightly. Mistakes are not evidence of a flawed system unless there is no adaptation. In the wake of DigiNotar the Web PKI has changed significantly and we are also in the process of adding TRANS. A possible model for future PKI is to think in terms of a victorian skyscraper. There is a steel structure and a brick exterior. Both are necessary for the structure to stand up. I think we need to rethink how the principle of least privilege applies here and make sure we are doing everything we can to minimize risk. As a matter of policy, no cert should ever issue for a private key that is not under the direct control of a CA unless one of the following apply to the corresponding cert: 1) The other party has CP, CPS and full audit for operating a CA. 2) There is a name constraint. 3) It is an end entity certificate. Further no private key should ever be in a network accessible device unless the following apply: 1) There is a path length constraint that limits issue to EE certs. 2) It is an end entity certificate. From nobody Thu Apr 2 12:14:06 2015 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3AD41A1DBC for ; Thu, 2 Apr 2015 12:14:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.666 X-Spam-Level: X-Spam-Status: No, score=-1.666 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OSiu3hklcVQF for ; Thu, 2 Apr 2015 12:14:04 -0700 (PDT) Received: from homiemail-a31.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) by ietfa.amsl.com (Postfix) with ESMTP id 392E01A1A30 for ; Thu, 2 Apr 2015 12:14:04 -0700 (PDT) Received: from homiemail-a31.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a31.g.dreamhost.com (Postfix) with ESMTP id 084E2202044; Thu, 2 Apr 2015 12:14:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h=date :from:to:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=cryptonector.com; bh=+Y82WWV/DbdoSt 7lJnAb0/gUWRw=; b=NOnrxLKrwqusV+fgyFr4u3CEg/fqv73bZRUmQ/8Zk9eQ9B saZNxN+ji+149w0GRZhxKqmMJpudhAS+r3oIqGrs2ykigVZdYnaO+1dMPxcuKMpd AfyBmmvdYR7mbEhPv7aoNZ04mXUfC4VuiBsXBk2nBu45F1+plYpIBFx8jAujo= Received: from localhost (108-207-244-174.lightspeed.austtx.sbcglobal.net [108.207.244.174]) (Authenticated sender: nico@cryptonector.com) by homiemail-a31.g.dreamhost.com (Postfix) with ESMTPA id 740C220203C; Thu, 2 Apr 2015 12:14:03 -0700 (PDT) Date: Thu, 2 Apr 2015 14:14:02 -0500 From: Nico Williams To: Phillip Hallam-Baker Message-ID: <20150402191401.GI10960@localhost> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Archived-At: Cc: "therightkey@ietf.org" Subject: Re: [therightkey] Principle of least privilege... X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2015 19:14:05 -0000 On Thu, Apr 02, 2015 at 01:46:48PM -0400, Phillip Hallam-Baker wrote: > As a matter of policy, no cert should ever issue for a private key > that is not under the direct control of a CA unless one of the > following apply to the corresponding cert: > > 1) The other party has CP, CPS and full audit for operating a CA. > 2) There is a name constraint. > 3) It is an end entity certificate. EE is a kind of name constraint. (1) is a non-starter, or would have been had we had universal deployment of name constraints. > Further no private key should ever be in a network accessible device > unless the following apply: > > 1) There is a path length constraint that limits issue to EE certs. > 2) It is an end entity certificate. Well, no, some CAs need to be on-line, but then they should have an online key and an off-line key signing the online key's cert. Nico --