On Tue, 30 Jul 2002, Benjamin wrote:
> I would consider both the phone and the notebook to be equivalent to two
> people communicating via pgp mail, each have their own private key.
Ok? Now, what's your equivalant to the standard way a web of trust is
built in PGP? How do you know that you have a particular device's public
key, and not something an impostor has created?
> The private key of the notebook is only on the notebook and protected by
> the passphrase. The private key of the phone is only on the phone and
> protected by PIN2.
What is the minimum length of this PIN2? How is it set? What if
you lose it?
> If you loose your phone, then that is like getting an email from a
> correspondent telling you that they have lost their key and that they
> revoked it....
So you basically add a revocation certificate to your keyring's copy of
the phone's key? What if you get your phoene back? How do you get the
phone to generate a new certificate?
> If the finder/thief of the phone however does not have the PIN2, nor the
> associated PUK2, then they would not be able to disable the trust put in
> the key of your notebook and thus, you will be able to access that phone
> remotely and tell it not to allow outgoing calls, start an alarm to tell
> bystanders that the phone is lost or stolen, or whatever else there may
> be.
How do you access it remotely? More importantly, how do you prevent the
finder/thief from accessing the phone? And what are the consequences of
that? (I guess this is answered below, for one method.)
> Likewise, if you loose your notebook, you could use PIN2 to tell the
> phone that any administrative access to the phone using the notebook's
> key is no longer authorised, but the finder/thief would need your
> passphrase in order to disable your phone's access to the notebook,
> unless they wipe it completely of course.
So you have to remember the PIN2 for every single device you have. What's
the point of using private key/public key encryption, then? Why not just
use the shared secret you already have?
> >> However, you do know that exhaustive search on a PIN will render the
> >> phone unusable and you will need a PUK to unlock it (likewise PUK2 for
> >> PIN2), don't you ?
> >
> > Of course. Now try to explain that to the consumer. ("I'm sorry--you
> > can't use your video camera until you take it to an authorized service
> > center. And that's not Bic Camera, because we sure as heck can't trust
> > them with keys to unlock every device we've manufactured.")
>
> Wouldn't happen that way. The camera will have its own private key in
> order to be able to let your notebook gain administrative access to it
> using the notebook's own key, but I would not expect the camera to be a
> device that should or even could have administrative access to the
> notebook.
You've got that backwards. I'm talking about what happens when the
consumer loses access to the device. You can't just reset the device,
can you? Or if you can, you've got a big security problem.
> As far as inbound admin access to the camera is concerned, you would use
> PIN2 of your camera to register (and remove) your notebook's and phone's
> keys and assign trust to allow (and disallow) such access.
Well, once again, it all depends on this PIN2 shared secret. So why
not just use that and be done with it? What does all this asymetric
encryption add?
(Note that normally with asymetric systems, the key management is *not*
done by protecting the key management transactions with a shared secret;
the whole point of asymetric encryption is that you don't have to do
that!)
> Over time it is reasonable to assume that other authentication methods
> than PINs will evolve. For example fingerprint readers or voice
> analysis.
Certainly it's not possible to assume either of those particular
ones. Fingerprint analysis has been shown recently to be trivially
spoofable, and voice analysis is up there with facial recognition
systems.
> And as a camera already has a lens and a CCD built-in it may
> eventually have a feature to recognise you by your face based on the
> various unique fix points and plus a heat print of your face (which can
> even distinguish identical twins).
"Can distinguish idential twins" under laboratory conditions and
"works in the field" are two completely different things. Please check
out the results of recent field tests of face recognition systems.
Anyway, I'm going to stop here, since this is getting old. I'm really
just failing to see how all of this is easier than just plugging in a
firewire cable between the two devices.
But one more comment:
> > Ha ha! I have only one word (or rather, acronym) for this: PKI.
>
> Sure, that's the base. The wheel which obviously need not be reinvented.
Uh, dude, PKI is currently a very, very square wheel. All attempts
to date to come up with a useful, consumer-scale PKI network have
failed miserably. Basically, we have no consumer-scale key management
infrastructure.
cjs
--
Curt Sampson <cjs_at_cynic.net> +81 90 7737 2974 http://www.netbsd.org
Don't you know, in this new Dark Age, we're all light. --XTC
Received on Wed Jul 31 03:51:37 2002