*PKI Labs Conference Call*
February 17, 2004

*Attendees*

Neal McBurnett (convener) - Internet2

Mark Franklin - Dartmouth

Eric Norman - Wisconsin

Olga Kornievskaia - Michigan
Peter Honeyman - Michigan
Carl Ellison - Microsoft
Krishna Sankar - Cisco
Bob Morgan - Washington
Peter Alterman - NIH

Ben Chinowsky (scribe) - Internet2

*Discussion*

Dartmouth's Mark Franklin discussed his proposal for PKI for P2P (see http://wiki.osafoundation.org/twiki/bin/view/Chandler/DartmouthPkiProposal). His proposal uses X.509 to provide a way for two peers to authenticate to each other without a lot of overhead. P2P applications issue self-signed certs, trusting each other at the cert level rather than the CA level. As the system works with keys directly, peers can give keys their own names (e.g. "user from Penn State"); in addition to being useful for working with anonymized certs, this avoid problems with names being created in one namespace but used in another. Mark noted that "the only really nonstandard thing" in his scheme is that the user at the peer that's acting as a server (e.g., being asked to share its calendar) sees a dialog saying "here's the thumbprint, do you approve?" Carl noted similarities between this work and SDSI-based work that Carl described in a paper with Steve Dohrmann at PKI02; see http://www.cs.dartmouth.edu/~pki02/Dohrmann/. Carl noted that a patent has been applied for for a scheme that uses a time sequence of icons to stand for a thumbprint and timestamp; others are working on using a thumbprint as a seed for a fractal generator, or representing a thumbprint as a sequence of musical tones.

Peter Alterman gave a quick overview of developments in Federal E-Authentication:
- The interim architecture has been accepted; see http://www.cio.gov/eauthentication/. The E-Authentication project has some money and is looking for R&D projects and multiagency implementations of the E-Authentication architecture. Chris Louden, head of the architecture working group, has asked for a proposal for a modified version of the interoperability model that would wrap an XML form in a Shibboleth assertion, with the E-Authentication infrastructure then doing the authN and accepting the assertion. Peter and Michael Gettes are working on a proposal along these lines.
- NIST has published a draft Recommendation for Electronic Authentication, focusing on levels of authN; see http://csrc.nist.gov/publications/drafts.html. [AI] All will send comments on the NIST Recommendation for Electronic Authentication to eauth-comment@nist.gov by March 15.
- Most Federal agencies have been put on notice that they'll have to have a risk assessment done by the standard CMU tools, with consequences to follow in case of failure to measure up. This has lit fires under quite a few people.

Carl offered some notes on his work with XrML. XrML makes use of "prerequisite rights" -- if an entity has rights A, grant it rights B -- with no requirement that the rights being granted make use of the same vocabulary as the prerequisites. This means that you can switch languages as you cross organizational boundaries. Of course, this requires generating contracts at the boundaries, but once that work is done, you have a very powerful capability. XrML offers great flexibility in how you define rights, and this access delegates down as long a chain as you want. XrML is more flexible than SPKI in that you can do arbitrary mappings; it's less flexible in that you have to specify those mappings one pair at a time. Carl is trying to get the people he's working with to avoid using the word "trust", and instead to think in terms of exhibitable "mechanically created proof constructs." This concept incorporates the idea of using the key directly, rather than reducing a key to a name and using the name. The mechanical proof machinery Carl has in mind doesn't need any cryptography; it's handed a batch of verified bodies of cryptographic statements, and operates off of them.

Neal suggested it would be good to see a comparison of what the various rights management languages can do and where they would be most useful. Krishna noted that there are a lot of patents in this area, and Neal suggested that perhaps pursuing such a comparison might turn up earlier, unencumbered work.

*Action Item*

[AI] All will send comments on the NIST Recommendation for Electronic Authentication to eauth-comment@nist.gov by March 15.