Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

5/23/2011
04:59 PM
Taher Elgamal
Taher Elgamal
Commentary
50%
50%

From Device to Device, From Site To Site

Obama administration's digital identities initiative relies on private industry to come together and make it work

The Obama administration is championing the idea of cyberidentities for U.S. citizens, and it’s asking for the private sector’s help.

I applaud this effort because, as I’ve discussed several times before, lack of identity verification or validation is responsible for the raft of bad things we’ve seen in recent years -- fraud, identity theft, espionage, and even cyberwars.

On the server authentication side, the administration isn’t recommending any particular technologies or methods because we already have SSL-- which understands credentials that are PKI-formatted -- and its certificates, whose trustworthiness has been improved during the years by the private sector.

The administration isn’t recommending particular technologies or methods for defining identity and authenticating users on the client side, either. Rather, it’s expressing confidence in the validity of the idea of cyberidentities -- and the private sector’s expertise -- by inviting all private-sector technology companies to participate in the project. The administration is acting as the broker of an operability experiment whose goal is for every participant to benefit from every other participant’s work.

Once the private sector finishes up this operability experiment and the client side is figured out, what will it mean for SSL?

Since we can’t map any sort of identity into a PKI credential, we’ll have to detach the client identity from the SSL session. Or rather, we could detach the client identity from the SSL session, theoretically, despite the fact that that’s not what’s really being talked about at the moment.

A reasonable architecture could be as simple as this: Imagine an application layer in a banking session. After the SSL handshake during which the server has been authenticated, the user is asked to authenticate herself. The applications and websites are then left with the burden of determining how the user’s identity is going to be supported. Period.

I think that’s a reasonable architecture. Some identities will be sent across the wire easily, while others will demand more work. Financial services, healthcare, and other sectors will have to choose a way to support the user’s identity.

The real difficulty comes when we ask the question, “What does operability mean?”

It would be really nice if all of these identities could live on top of a single infrastructure. But that infrastructure doesn’t yet exist. Each site or enterprise is building its own user authentication. That means each provider of an identity authentication concept will have to sell to the number of servers it would like to, and that will leave us with a fragmented market. That’s where we are today.

What would be better is if the government encouraged the private sector to build an infrastructure that supports all strong authentication systems with a single API so that regardless of which identity the back end would like to authenticate, the front end will say, “Yes, I support A, B, and C,” and the back end will choose A, B, or C. A small authentication and negotiation protocol layer could then be supported that allows sites to choose the identity types that they would like to support.

Exactly how we’re going to map all of this together -- that’s another story. It’ll be a huge effort because each user has several different types of identities that need supporting (to say nothing about different types of devices, like smartphones and tablets), and each site chooses which of those types of identities it will support.

It’s as if we need a magical infrastructure -- one that can tie an identity to the same trusted user going from device to device and from site to site, and confirm that this is most probably the same trusted user it encountered before.

After 16 years, we’re still not where we had hoped we would be on this. Then again, with all the progress the industry has made in that time, the place we’re at is a pretty good compromise, and the Obama administration’s efforts will surely take us to the next level.

Recognized in the industry as the "inventor of SSL," Dr. Taher Elgamal led the SSL efforts at Netscape. He also wrote the SSL patent and promoted SSL as the Internet security standard within standard committees and the industry. Dr. Elgamal invented several industry and government standards in data security and digital signatures area, including the DSS government standard for digital signatures. In addition to serving on numerous corporate advisory boards, Dr. Elgamal is the Chief Security Officer at Axway, a global provider of multi-enterprise solutions and infrastructure. He holds a Ph.D. and M.S. in Computer Science from Stanford University. View more of his blog posts here.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31414
PUBLISHED: 2021-04-16
The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configuration.
CVE-2021-26073
PUBLISHED: 2021-04-16
Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or ...
CVE-2021-26074
PUBLISHED: 2021-04-16
Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a se...
CVE-2018-19942
PUBLISHED: 2021-04-16
A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QT...
CVE-2021-27691
PUBLISHED: 2021-04-16
Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request...