On 8/25/06, Badger <badger at scattermail.com> wrote:
> I'm not sure that I fully understand your description of the
> ROS service. For instance, when you say the user's password is
> XOR'd, what exactly is it XOR'd with? Also, could you clarify
> if there are two passwords in operation: one for the private
> key, and one for the keystore (the pkcs12 file).
A PKCS12 file is both, check the RSA faq for more details. I forget
what its XOR'd with, probably itself, or itself backways. If its
really important to you, I can check it out, still have the rebuilt
code here somewhere.
> Despite my lack of understanding, it appears to me that the
> ROS service you have described has very little in common with
> an SSH session. In fact, the two are fundamentally different.
Very correct. The thread wandered if you'd been following it.
> The reason that the ROS can control policy with respect to
> key passwords is that the user is running ROS's client. This
> java client, which you download from their site, can apply
> policy in any manner that it wants. The whole PKCS#12 thing
> is incidental. In fact, there's really no need for them to
> store the private key on the user's disk at all - they could
> have stored them in some encrypted form on their own servers
> in a similar vein to what Hush Communications do with HushMail.
There would be legal implications of that with respect to non
repudiation, and ROS couldn't actually legally depend on signed tax
returns in such a manner. The key must be in the posession and control
of the signer. Thats stipulated by law. Hushmail provide a secure
communications platform, they're not interested in the legal validity
of digital signatures for the purposes of non repudiation.
> The actually service carried out by ROS occurs over a closed
> protocol. I imagine that if you could reverse engineer your own
> client that could communicate with the ROS server using that
> protocol then you could store the private key in plaintext if
> you wanted.
No. The PKCS12 format does not permit this, check the RSA faq. Also,
understand that the ROS applet is purely for authentication and for
signing. Everything else is carried out through webservices. Signing,
for legal purposes, takes place on the client machine, not the server,
thats a legal stipulation surrounding the non repudiation of digital
signatures. It boils down to, did I sign the doc electronically on my
machine, or did I send my doc and my key to ROS and get them to sign
it for me. Personally, I wish it was the otherway, but the drink
driving law experts were busy or drunk that day, and the guys who
don't leave loopholes were on this case.
> An SSH session uses an open standards protocol which allows any
> complient client to communicate with any complient server. In
> this circumstance, it is simply beyond the powers of the server
> to dicate how the client will manage it's keys.
Which is why I asked if anyone knew of an SSH client which worked with
PKCS12 keys. It would be a non standard SSH client which many
professional organisations would have much interest in terms of
maintaining security standards around password strengths etc. It
appears that it simply does not exist, or if it does, nobody on this
list has heard of it.
> > So... if you want to manage users passwords for certificate files, you
> > need to wrap with something like that which uses software traps to
> > archive passwords etc if necessary. Its really what PKI is all about,
> > scnearios and policies and mitigating the risks. The joys of
> > opensource software is that this can easily be implemented in an
> > organisation without having to invest heavily in employing a large PKI
> > implementor!
> >
>> Hmm! PKI == kludge
Actually, if you read the Sunday Business Post "comptuers in business"
magazine whenever they run a security story, you'll see the same three
or four names crop up, the boys who pay their way in to comment on
security in the magazine. So PKI actually == an expensive date with
one of those three or four ugly models!
:-)
Aine.
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
