Subject: [pkix] WGLC for draft-ietf-pkix-certimage-06

From: Stephen Kent <[email-masked]>
Date: Wed, 24 Feb 2010 09:40:40 -0500

Folks,

Stefan has recently posted a revised verison of this document and 
requested EGLC.  I have seen one response indicating that changes 
made by Stefan addressed comments from that individual. So, lets 
start our usual 2 week WGLC today.  It will end on March 11 (plus or 
minus 1 allowance).

Thanks,

Steve

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 24 Feb 2010 10:44:23 -0800

Greetings again. I continue to oppose this document as a new standard.

The document assumes that giving users better pictures will help those users make security choices. We have years of experience with RFC 3709, and none of that experience supports that assumption. The argument that "the earlier format wasn't expressive enough" is not supportable, given that none of the common web browsers or email clients even bothered with the earlier format. The need for this document is speculative, at best.

Further, the document adds three new complex display formats with completely insufficient security considerations about how displaying malicious forms of those formats can cause security-essential software to fail. Avoiding putting these types of issues in the Security Considerations section does a grave disservice to the security community and makes us look hypocritical, given how often we force other protocols to put more detail in their Security Considerations section.

---

From: Stefan Santesson <[email-masked]>
Date: Thu, 25 Feb 2010 10:34:52 +0100

Greetings Paul,

On 10-02-24 7:44 PM, "Paul Hoffman" <[email-masked]> wrote:

> The document assumes that giving users better pictures will help those users
> make security choices.

Not necessarily. It's a usability feature more than a security feature. To
the extent it provides better security to understand what you are looking
at, it provides better security.

> We have years of experience with RFC 3709, and none of
> that experience supports that assumption.

Ok, and what is that experience?
My personal experience with RFC3709 is that it was a good idea, but still to
hard to implement to gain momentum.

> The argument that "the earlier
> format wasn't expressive enough" is not supportable, given that none of the
> common web browsers or email clients even bothered with the earlier format.
> The need for this document is speculative, at best.

It is supported by major vendors that have said so on this list. It is also
a candidate solution for a standard on visible signatures in EU. It is
further supported by other vendors that don't communicate on this list.

This is more than enough to motivate publication of an RFC.

> 
> Further, the document adds three new complex display formats with completely
> insufficient security considerations about how displaying malicious forms of
> those formats can cause security-essential software to fail. Avoiding putting
> these types of issues in the Security Considerations section does a grave
> disservice to the security community and makes us look hypocritical, given how
> often we force other protocols to put more detail in their Security
> Considerations section.

This information is consumed by an UI, it is not consumed by the security
kernel.

A normal user render graphical images of various formats on a daily basis
from totally un-trusted sources. Nobody think this is an unacceptable
security risk. Just try to stop the use of images over the internet with the
argument that rendering images is too dangerous..

Well, everybody clearly understands that the response to the threats
introduced by images, is not to make Internet text based, but to produce
formats and rendering tools that is constantly tested for security issues.

The present document suggest that a trusted CA, not an un-trusted source,
should be able to provide a SIGNED image, using the same formats that are
used by browsers over the internet, except that we limit the functionality
of these formats for further security.

If you think the security considerations section is inadequate then feel
free to help improve it, but to claim that this is to dangerous is not based
on reason.

/Stefan