Public Key Infrastructure - Revision history

Tom: /* Federation */

2023-12-06T21:20:23Z

‎Federation

Tom: /* Federation */

2023-12-06T21:09:32Z

‎Federation

Tom: /* Solutions */

2023-12-06T21:06:01Z

‎Solutions

Tom: /* Problems */

2021-08-04T22:34:20Z

‎Problems

Tom: /* Certificate filename extensions */

2019-05-06T06:00:19Z

‎Certificate filename extensions

Tom: /* Certificate filename extensions */

2019-05-06T05:59:42Z

‎Certificate filename extensions

Tom: /* Certificate filename extensions */

2019-05-06T05:58:08Z

‎Certificate filename extensions

Tom: /* Certificate filename extensions */

2019-04-24T20:13:23Z

‎Certificate filename extensions

Tom: /* Certificate filename extensions */

2019-04-24T20:12:13Z

‎Certificate filename extensions

Tom: /* Solutions */

2019-04-24T20:10:55Z

‎Solutions

@@ Line 31: / Line 31: @@
 The problems with PKI have resulted in lots of standards to create something better. But in the end nothing better that a certificate trust chain has actually worked. Some examples:
 ===Federation===
-The whole point of a [[Federated Ecosystem]] is to create the sort of space that already exists for [[TLS]]. It should be noted that [[TLS]] is Transport Layer Security, while most of [[Identifier and Access Management]] operates at the application level.
+The whole point of a [[Federated Ecosystem]] is to create the sort of space that already exists for [[TLS]]. It should be noted that [[TLS]] is Transport Layer Security, while most of [[Identifier and Access Management]] operates at the application level. Since IP and transport layer security did a great job at creating secure solutions there has been an effort called [[Channel Binding]] to use that secured link to bind the user [[Identifier]] using that secure basis. The problem, as pointed out in the [[Channel Binding]] page is that large computer systems are often architected to put lower level function in a different physical device from the application. So a fully application level standard, like a [[Federation Service]] may not be able to use lower level protocols.
 ===Trust Registries===

@@ Line 31: / Line 31: @@
 The problems with PKI have resulted in lots of standards to create something better. But in the end nothing better that a certificate trust chain has actually worked. Some examples:
 ===Federation===
-The whole point of a [[Federated Ecosystem]] is to create the sort of space that already exists for TLS.
+The whole point of a [[Federated Ecosystem]] is to create the sort of space that already exists for [[TLS]]. It should be noted that [[TLS]] is Transport Layer Security, while most of [[Identifier and Access Management]] operates at the application level.
 ===Trust Registries===
 There appears to be no difference between a [[Trust Registry]] and a [[Certificate Authority]] except for the hype.

← Older revision		Revision as of 21:06, 6 December 2023
Line 27:		Line 27:

	[[PKCS 12\|PKCS#12]] evolved from the ''personal information exchange'' (PFX) standard and is used to exchange public and private objects in a single file.		[[PKCS 12\|PKCS#12]] evolved from the ''personal information exchange'' (PFX) standard and is used to exchange public and private objects in a single file.
		+
		+	==Back to the Future==
		+	The problems with PKI have resulted in lots of standards to create something better. But in the end nothing better that a certificate trust chain has actually worked. Some examples:
		+	===Federation===
		+	The whole point of a [[Federated Ecosystem]] is to create the sort of space that already exists for TLS.
		+	===Trust Registries===
		+	There appears to be no difference between a [[Trust Registry]] and a [[Certificate Authority]] except for the hype.

	==References==		==References==

@@ Line 10: / Line 10: @@
 ==Problems==
 *[[Enterprise]]s were willing to tolerate the pain introduced with PKI, but not a signification number of [[User]]s that could not be compelled to submit to the pain.
-*Problems have been known for a long time<ref>Robert A. Grimes, ''4 Fatal Problem with PKI.'' (2015) CSO https://www.csoonline.com/article/2942072/security/4-fatal-problems-with-pki.html</ref>
+*Problems have been known for a long time from Robert Grimes<ref>Robert A. Grimes, ''4 Fatal Problem with PKI.'' (2015) CSO https://www.csoonline.com/article/2942072/security/4-fatal-problems-with-pki.html</ref> and [https://www.cs.auckland.ac.nz/~pgut001/#standards Peter Gutmann]
 ==Solutions==

@@ Line 22: / Line 22: @@
 * <tt>.p7b</tt>, <tt>.p7c</tt> – [[PKCS 7|PKCS#7]] SignedData structure without data, just certificate(s) or [[revocation list|CRL]](s)
 * <tt>.p12</tt> – [[PKCS 12|PKCS#12]], may contain certificate(s) (public) and [[Private Key Component]]s (password protected)
-* <tt>.pfx</tt> – PFX, predecessor of PKCS#12 (usually contains data in PKCS#12 format, e.g., with PFX files generated in by a bowser like Internet Information Services - IIS)
+* <tt>.pfx</tt> – PFX, predecessor of PKCS#12 (usually contains data in PKCS#12 format, e.g., with PFX files generated in by a bowser like Microsoft's Internet Information Services - IIS)
 [[PKCS 7|PKCS#7]] is a standard for signing or encrypting (officially called "enveloping") data. Since the certificate is needed to verify signed data, it is possible to include them in the SignedData structure. A <tt>.P7C</tt> file is a degenerated SignedData structure, without any data to sign.

@@ Line 20: / Line 20: @@
 * <tt>.pem</tt> – (Privacy-enhanced Electronic Mail) [[Base64]] encoded [[Distinguished Encoding Rules|DER]] certificate, enclosed between "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----"
 * <tt>.cer</tt>, <tt>.crt</tt>, <tt>.der</tt> – usually in binary [[Distinguished Encoding Rules|DER]] form, but Base64-encoded certificates are common too (see <tt>.pem</tt> above)
-* <tt>.p7b</tt>, <tt>.p7c</tt> – [[PKCS7|PKCS#7]] SignedData structure without data, just certificate(s) or [[revocation list|CRL]](s)
+* <tt>.p7b</tt>, <tt>.p7c</tt> – [[PKCS 7|PKCS#7]] SignedData structure without data, just certificate(s) or [[revocation list|CRL]](s)
-* <tt>.p12</tt> – [[PKCS12|PKCS#12]], may contain certificate(s) (public) and [[Private Key Component]]s (password protected)
+* <tt>.p12</tt> – [[PKCS 12|PKCS#12]], may contain certificate(s) (public) and [[Private Key Component]]s (password protected)
 * <tt>.pfx</tt> – PFX, predecessor of PKCS#12 (usually contains data in PKCS#12 format, e.g., with PFX files generated in [[Internet Information Services|IIS]])
-[[PKCS7|PKCS#7]] is a standard for signing or encrypting (officially called "enveloping") data. Since the certificate is needed to verify signed data, it is possible to include them in the SignedData structure. A <tt>.P7C</tt> file is a degenerated SignedData structure, without any data to sign.
+[[PKCS 7|PKCS#7]] is a standard for signing or encrypting (officially called "enveloping") data. Since the certificate is needed to verify signed data, it is possible to include them in the SignedData structure. A <tt>.P7C</tt> file is a degenerated SignedData structure, without any data to sign.
-[[PKCS12|PKCS#12]] evolved from the ''personal information exchange'' (PFX) standard and is used to exchange public and private objects in a single file.
+[[PKCS 12|PKCS#12]] evolved from the ''personal information exchange'' (PFX) standard and is used to exchange public and private objects in a single file.
 ==References==

@@ Line 15: / Line 15: @@
 *The basic business model of selling [[Trust]] for money can never work in a capitalist economy. Any standard causes a [https://en.wikipedia.org/wiki/Race_to_the_bottom race to the bottom]. PKI should be abandonded, but the problem is proposing a workable solution that is financially sound as well as a secure expresseion of [[Trust]] is not known in late 2018.
 *[[FIDO U2F]] will put a [[Trust]] token in the hands of users, but does not help the bigger problem, how to [[Trust]] the [[Web Site Identity]].
 ==References==