EU GridPMA meeting Dublin, January 2010 Jens’ Soapbox EU GridPMA meeting Dublin, January 2010

Soapboxes Explain Expose Expatiate Explicate Expand Expedite Expostulate Experiment Explore

This soapbox is about…Trust Meaning Trustworthiness (more or less) What it is, properties Why we have it Building it W&F

Trust – WN definitions “Certainty based on past experience,” reliance “The trait of believing in the honesty and reliability of others” “Complete confidence in a person or plan, etc”

Consider WoTs Like Thawte’s WoT Or PGP Trust Model

Relations Relations properties from maths: Reflexive: a~a Symmetric: a~b => b~a Transitive: a~b & b~c => a~c A relations may have any or all of these properties Exercise: prove or disprove S&T=>R

Reflexivity “I trust myself” … or do I? Why we have best practices The unknowns The known unknowns And the unknown unknowns

Building Trust Timeo Hominem Unius Libri Based on reputation Ideas Knowledge/skill (evidence of) Honesty/integrity (perceived, assumed) Contributions 2nd hand information (or 3rd etc)

Building Trust Basic F2F meeting – TrustBuilding Doing what is expected Not necessarily what we expect… We may expect people to not do what is expected

Trust based on Knowledge Knowledge pertaining to operation of CA Knowing what to do Normally Exceptional cases (devious flow) When something goes wrong

Improving Knowledge Normal operations Devious flow Training for CA managers? Devious flow Documentation – CAOPS Or covered by CA’s policy Papal infallibility

Improving Knowledge Sharing between CA managers Off the record When something goes wrong Gather unto the RAT for advice Assuming the combined RAT has the skills

Symmetry Some acts establish symmetric trust E.g. PMA trustbuilding Some are asymmetric establishers PMA accreditation Some acts break symmetry E.g. violating minreq

Transitivity Alice trusts Bob Bob trusts Charlie Charlie trusts Donna (etc) B C A D

Transitivity If numbers model the Level of Trust: Any practical use of such models? (rhetorical question for now…) .8 .8 B C .8 A D

Numbers Of course they don’t… [0,1] Fuzzy logic closer (not warm and fuzzy) Basic scientific principles: Subjective Emotional

Transitivity? PMA CA RP RA User

Transitivity? IGTF PMA CA RP RA User

Transitivity? IGTF PMA CA RP RA User Terena Inst.

Painting by Numbers Has been studied for PGP C A B D T1(a,b,t):=S(T(a,b,t),P(T(a,c,t),T(c,b,t)),P(T(a,d,t),T(d,b,t)))

Implementation Digital vs mechanical vs procedural Cf revoking physical key in real world Electronic locks PKI implements Trust Or does it? It implements a projection

Implementation

Requiring vs Enforcing Stalin: “Trust is good, control is better.” Me: “Just because you can’t – or don’t – enforce it doesn’t mean you shouldn’t require it.”

Requiring – Examples Cf. TERENA discussion Cf user passphrase length Institution promises to behave NREN checks if something goes wrong Cf user passphrase length Traceability of robot certs (if applicable)

Requiring vs Enforcing Require Requirements at time of agreement Follow up if something goes wrong Enforce Check and validate at time of agreement

Requiring vs Enforcing Less W&F Impose higher sanctions Validator disclaims responsibility? Enforcing Warmer and fuzzier Fewer sanctions for misuse Validator has part of responsibility

The Time Dimension Continuity Depreciation Staff change – handover process Disaster recovery Depreciation Re-establish trust

The Warm and Fuzzy Feeling Traceability By DN Via CA (usually) Naming the subject “Fuzzy matching” Uniqueness of names

A Deo Rex, A Rege Lex PMA CA RA User

The Time Dimension PMA CA RA User Revise Implement Re-check Rekey

Compare WoTs We are more structured and hierarchical Like CAs, really Can we learn from WoTs? Consequences of Type 1 Errors? Consequences of Type 2 Errors?

Basic Exercises How many reviewers does it take to review a CA How does this depend on their experience Process developed as we go along

Basic Exercises Would you trust my digital identity more if I had two, from different RAs (CAs) Would you trust it more if verified by more than one RA? How does this depend on the experience/training of the RA?

More Useful Exercises What are the goals we aim to achieve Cf some previous soapboxen Assurance Writing up into the document currently known as “essentials”

Advanced Case Studies? The need to revet (re-vet) identities Which time problem does it deal with? How does it deal with it? Are we solving a problem we don’t have Or can be solved in a better way Not enough things on top of other things But too many carts before horses

Conclusion(s) Trust models operate with incomplete information Implementations are (crude) approximations Academic models of some use

Conclusions(s) Potential benefits from more complex trust models Instead of solving the problem, identify the problem Then (and only then) solve it