SKS/KeyGen2 for Linux

classic Classic list List threaded Threaded
8 messages Options
Reply | Threaded
Open this post in threaded view
|

SKS/KeyGen2 for Linux

Anders Rundgren-2
Having been encouraged by a message from Mr. Linu{s|x} himself, that
"the security people will never agree on anything" (which probably is correct...) ,
I will slowly but surely port the SKS/KeyGen2 concept to Linux:
https://openkeystore.googlecode.com/svn/resources/trunk/docs/sks-api-arch.pdf

Unfortunately I have have reached a temporary setback because I have found
out that Google will never support XML Schema in Android which makes KeyGen2
dependent on _my_ ports of pretty giant third-party libraries like Apache's XML suite.
In addition, the web-world seems to be hooked on JSON so this is what KeyGen2
will be rewritten in. However, using JSON isn't completely without issues either:

http://webpki.org/papers/PKI/converting-xmldsig-2-json.pdf

Since SKS/KeyGen2 anyway relies on concepts that have very little support in standards
like SM (Secure Messaging), I'm probably going to use proprietary definitions of JSON
crypto objects for the reasons just stated.  The parser will probably check in at 3K-5K
lines so it is not really comparable to the 200K line (!) XML XSD/DSig.

On the lower-end of things, the SKS, I will swap the WS-interface for serialized binary
that should run fine both with Android's "binder" and Linux' D-Bus.  The client-code
for all implementations will (like the current WS-interface
https://code.google.com/p/openkeystore/source/browse/library/trunk/build/sks-ws-descriptor.xml)
be auto-generated from a single definition file.  Skipping WS will make life much simpler :-)

Cheers
Anders


------------------------------------------------------------------------------
Get 100% visibility into Java/.NET code with AppDynamics Lite!
It's a free troubleshooting tool designed for production.
Get down to code-level detail for bottlenecks, with <2% overhead.
Download for free and get started troubleshooting in minutes.
http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
_______________________________________________
Opensc-devel mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/opensc-devel
Reply | Threaded
Open this post in threaded view
|

Re: SKS/KeyGen2 for Linux

Jean-Michel Pouré - GOOZE
Le lundi 19 août 2013 à 11:33 +0200, Anders Rundgren a écrit :
> I will slowly but surely port the SKS/KeyGen2 concept to Linux:
> https://openkeystore.googlecode.com/svn/resources/trunk/docs/sks-api-arch.pdf 

Dear Anders,

I don't fully understand the notion of security model defined in 2.4
where "user grants an issuer the right to create keys in the SKS."

Do you mean "we should leave you our laptop, while we are out for lunch,
to keep it safe"?

Are your really going to elaborate a software around this "obscure"
notion of security? Most security agencies are turning to be more strict
and I doubt that this security scheme can survive a long time.

Kind regards,
--
                  Jean-Michel Pouré - Gooze - http://www.gooze.eu

------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and
AppDynamics. Performance Central is your source for news, insights,
analysis and resources for efficient Application Performance Management.
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
_______________________________________________
Opensc-devel mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/opensc-devel

smime.p7s (7K) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: SKS/KeyGen2 for Linux

NdK-3
Il 23/08/2013 10:31, Jean-Michel Pouré - GOOZE ha scritto:

> I don't fully understand the notion of security model defined in 2.4
> where "user grants an issuer the right to create keys in the SKS."
Your bank asks access to your token. You grant it the right to create
keys and from this moment it cak create new keys "on your token" when
needed.
Then your cloud provider sets up a smart-card access for accounts: you
grant him the privilege to create keys on your token like you did for
the bank.
Obviously the provider won't be able to create/use keys in the "bank
area" and viceversa.

> Do you mean "we should leave you our laptop, while we are out for lunch,
> to keep it safe"?
Uh?

> Are your really going to elaborate a software around this "obscure"
> notion of security? Most security agencies are turning to be more strict
> and I doubt that this security scheme can survive a long time.
I think it's the only that can support a single store for "unlimited"
virtual identities...

BYtE,
 Diego.


------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and
AppDynamics. Performance Central is your source for news, insights,
analysis and resources for efficient Application Performance Management.
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
_______________________________________________
Opensc-devel mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/opensc-devel
Reply | Threaded
Open this post in threaded view
|

Re: SKS/KeyGen2 for Linux

Jean-Michel Pouré - GOOZE
Le vendredi 23 août 2013 à 13:39 +0200, NdK a écrit :
> Your bank asks access to your token. You grant it the right to create
> keys and from this moment it cak create new keys "on your token" when
> needed.

What you call a "bank" can later access your keyring and add
information. Enrollment process is direct from provider to final
consumer without SO-Officer. Final consumer may not be aware of security
considerations. With Facebook, Google and various online services, there
is a tendency to "overclick" when a flow of information is send to final
user. And who is controlling the security provider and in which country
is situated what you call "cloud" and what is the legislation? Does the
legislation of provider apply or legislation of the user?

The "bank" is asking for my laptop and tells me "Ok, we can take care of
your laptop, go and have a beer while we add keys in your laptop, under
our own laws".

Just my 2 cents.

Kinds regards,
--
                  Jean-Michel Pouré - Gooze - http://www.gooze.eu

------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and
AppDynamics. Performance Central is your source for news, insights,
analysis and resources for efficient Application Performance Management.
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
_______________________________________________
Opensc-devel mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/opensc-devel

smime.p7s (7K) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: SKS/KeyGen2 for Linux

Anders Rundgren-2
On 2013-08-23 14:06, Jean-Michel Pouré - GOOZE wrote:
> Le vendredi 23 août 2013 à 13:39 +0200, NdK a écrit :
>> Your bank asks access to your token. You grant it the right to create
>> keys and from this moment it cak create new keys "on your token" when
>> needed.

I think this step is closer to the acceptance of a cookie.

If the issuer also provides a KMK (Key Management Key) during provisioning,
keys can be updated although the user must still actually browse to the issuer site.

However, one can imagine automatic updates based on attributes
supplied with keys.  This would work analogous to SW updates.


> What you call a "bank" can later access your keyring and add
> information. Enrollment process is direct from provider to final
> consumer without SO-Officer. Final consumer may not be aware of security
> considerations. With Facebook, Google and various online services, there
> is a tendency to "overclick" when a flow of information is send to final
> user. And who is controlling the security provider and in which country
> is situated what you call "cloud" and what is the legislation? Does the
> legislation of provider apply or legislation of the user?
>
> The "bank" is asking for my laptop and tells me "Ok, we can take care of
> your laptop, go and have a beer while we add keys in your laptop, under
> our own laws".

This system is designed to replace passwords, not giving external
parties access to your computer.

Cheers
Anders


> Just my 2 cents.
>
> Kinds regards,
>
>
>
> ------------------------------------------------------------------------------
> Introducing Performance Central, a new site from SourceForge and
> AppDynamics. Performance Central is your source for news, insights,
> analysis and resources for efficient Application Performance Management.
> Visit us today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
>
>
>
> _______________________________________________
> Opensc-devel mailing list
> [hidden email]
> https://lists.sourceforge.net/lists/listinfo/opensc-devel
>


------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and
AppDynamics. Performance Central is your source for news, insights,
analysis and resources for efficient Application Performance Management.
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
_______________________________________________
Opensc-devel mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/opensc-devel
Reply | Threaded
Open this post in threaded view
|

Re: SKS/KeyGen2 for Linux

Jean-Michel Pouré - GOOZE
> I think this step is closer to the acceptance of a cookie.
> This system is designed to replace passwords, not giving external
> parties access to your computer.

I agree with you.

Also, keep in mind that SKS/KeyGen2 will allow https communications with
major US vendors (Facebook, Google, etc ...) like a breeze. All data
will end-up in a huge data center in the desert.

The advantages of System Officer and local management of PKI is that
there is some control of individuals, companies and governments on their
own PKI and information flows. We publish our own laws, so why should we
give away the right to manage our own PKI?

I consider SKS/KeyGen2 as a US Government project. If you are working
for free on SKS/KeyGen2, please ask for a salary!

From a pure legal point, I don't think this is legal in all countries to
manage a PKI in a cloud, situated nowhere, with no control. Google is
pushing around with the same moto: "we are not aware of local laws".

Just my 2 cents, I will stop there to avoid filling the list. Flame wars
are not good for communities.

Just do the right thing.

Kind regards,
--
                  Jean-Michel Pouré - Gooze - http://www.gooze.eu

------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and
AppDynamics. Performance Central is your source for news, insights,
analysis and resources for efficient Application Performance Management.
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
_______________________________________________
Opensc-devel mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/opensc-devel

smime.p7s (7K) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: SKS/KeyGen2 for Linux

Anders Rundgren-2
On 2013-08-26 11:21, Jean-Michel Pouré - GOOZE wrote:
>> I think this step is closer to the acceptance of a cookie.
>> This system is designed to replace passwords, not giving external
>> parties access to your computer.
>
> I agree with you.

Even the traditionalists have waken up:

http://www.w3.org/wiki/images/6/6f/SysApp_-_Secure_Element_API_-_intro.pdf

It will be fun!

Cheers
Anders

>
> Also, keep in mind that SKS/KeyGen2 will allow https communications with
> major US vendors (Facebook, Google, etc ...) like a breeze. All data
> will end-up in a huge data center in the desert.
>
> The advantages of System Officer and local management of PKI is that
> there is some control of individuals, companies and governments on their
> own PKI and information flows. We publish our own laws, so why should we
> give away the right to manage our own PKI?
>
> I consider SKS/KeyGen2 as a US Government project. If you are working
> for free on SKS/KeyGen2, please ask for a salary!
>
> From a pure legal point, I don't think this is legal in all countries to
> manage a PKI in a cloud, situated nowhere, with no control. Google is
> pushing around with the same moto: "we are not aware of local laws".
>
> Just my 2 cents, I will stop there to avoid filling the list. Flame wars
> are not good for communities.
>
> Just do the right thing.
>
> Kind regards,
>
>
>
> ------------------------------------------------------------------------------
> Introducing Performance Central, a new site from SourceForge and
> AppDynamics. Performance Central is your source for news, insights,
> analysis and resources for efficient Application Performance Management.
> Visit us today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
>
>
>
> _______________________________________________
> Opensc-devel mailing list
> [hidden email]
> https://lists.sourceforge.net/lists/listinfo/opensc-devel
>


------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and
AppDynamics. Performance Central is your source for news, insights,
analysis and resources for efficient Application Performance Management.
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
_______________________________________________
Opensc-devel mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/opensc-devel
Reply | Threaded
Open this post in threaded view
|

Re: SKS/KeyGen2 for Linux

Jean-Michel Pouré - GOOZE
Le lundi 26 août 2013 à 11:27 +0200, Anders Rundgren a écrit :
> Even the traditionalists have waken up:
> http://www.w3.org/wiki/images/6/6f/SysApp_-_Secure_Element_API_-_intro.pdf
> It will be fun!

I see your point and agree that SKS/KeyGen2 is user and business
friendly. So everyone is pushing in the same direction, even if not
perfectly legal, with the same moto: "we are not aware of local laws".

So what?

It is very usual for me to order on Google Play, eBay or Amazon and
receive the goods the next day with an invoice in Ireland or Luxemburg
with little or no VAT. The French government is loosing billions in
revenues every years and does not really complains, other than words
like "we don't agree". Therefore, those companies have a tendency to
believe that everything they do is perfectly legal and their users also
believe that if those companies behave like that, it is legal. IMHO, it
is could be interesting for those companies to have more and more
crypto, on the fly, with no control around taxes.

To make a comparison, as a kid, there used to be a No-cross sign on a
rather high speed road, in my home-town . Everyone used to cross in
front of that No-cross sign, simply because it was pretty convenient to
reach the railway station. So many people crossed that pavement was
wearing off. In the end, 3 or 4 years later, authorities installed a
public crossing.

On the converse, when individuals and states loose power and money, this
might not always stay "as-if". As an individual, I am quite concerned
how our money is spent in schools, universities, public services and
event defense, in France, not in Luxemburg or Ireland.

IMHO, this is the real picture behind this project.

Kind regards,
--
                  Jean-Michel Pouré - Gooze - http://www.gooze.eu

------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and
AppDynamics. Performance Central is your source for news, insights,
analysis and resources for efficient Application Performance Management.
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
_______________________________________________
Opensc-devel mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/opensc-devel

smime.p7s (7K) Download Attachment