1. EU GridPMA meeting Dublin, January 2010
Jens’ Soapbox
EU GridPMA meeting
Dublin, January 2010

2. Soapboxes Explain Expose Expatiate Explicate Expand Expedite
Expostulate
Experiment
Explore

3. This soapbox is about…Trust
Meaning Trustworthiness (more or less)
What it is, properties
Why we have it
Building it
W&F

4. Trust – WN definitions “Certainty based on past experience,” reliance
“The trait of believing in the honesty and reliability of others”
“Complete confidence in a person or plan, etc”

5. Consider WoTs
Like Thawte’s WoT
Or PGP Trust Model

6. Relations Relations properties from maths:
Reflexive: a~a
Symmetric: a~b => b~a
Transitive: a~b & b~c => a~c
A relations may have any or all of these properties
Exercise: prove or disprove S&T=>R

7. Reflexivity “I trust myself” … or do I? Why we have best practices
The unknowns
The known unknowns
And the unknown unknowns

8. Building Trust Timeo Hominem Unius Libri Based on reputation Ideas
Knowledge/skill (evidence of)
Honesty/integrity (perceived, assumed)
Contributions
2nd hand information (or 3rd etc)

9. Building Trust Basic F2F meeting – TrustBuilding
Doing what is expected
Not necessarily what we expect…
We may expect people to not do what is expected

10. Trust based on Knowledge
Knowledge pertaining to operation of CA
Knowing what to do
Normally
Exceptional cases (devious flow)
When something goes wrong

11. Improving Knowledge Normal operations Devious flow
Training for CA managers?
Devious flow
Documentation – CAOPS
Or covered by CA’s policy
Papal infallibility

12. Improving Knowledge Sharing between CA managers
Off the record
When something goes wrong
Gather unto the RAT for advice
Assuming the combined RAT has the skills

13. Symmetry Some acts establish symmetric trust
E.g. PMA trustbuilding
Some are asymmetric establishers
PMA accreditation
Some acts break symmetry
E.g. violating minreq

14. Transitivity Alice trusts Bob Bob trusts Charlie
Charlie trusts Donna (etc) B C A D

15. Transitivity If numbers model the Level of Trust:
Any practical use of such models?
(rhetorical question for now…) .8 .8 B C .8 A D

16. Numbers Of course they don’t… [0,1]
Fuzzy logic closer (not warm and fuzzy)
Basic scientific principles:
Subjective
Emotional

17. Transitivity?
PMA CA RP RA
User

18. Transitivity?
IGTF
PMA CA RP RA
User

19. Transitivity?
IGTF
PMA CA RP RA
User
Terena
Inst.

20. Painting by Numbers Has been studied for PGP C A B D
T1(a,b,t):=S(T(a,b,t),P(T(a,c,t),T(c,b,t)),P(T(a,d,t),T(d,b,t)))

21. Implementation Digital vs mechanical vs procedural
Cf revoking physical key in real world
Electronic locks
PKI implements Trust
Or does it?
It implements a projection

22. Implementation

23. Requiring vs Enforcing
Stalin: “Trust is good, control is better.”
Me: “Just because you can’t – or don’t – enforce it doesn’t mean you shouldn’t require it.”

24. Requiring – Examples Cf. TERENA discussion Cf user passphrase length
Institution promises to behave
NREN checks if something goes wrong
Cf user passphrase length
Traceability of robot certs (if applicable)

25. Requiring vs Enforcing
Require
Requirements at time of agreement
Follow up if something goes wrong
Enforce
Check and validate at time of agreement

26. Requiring vs Enforcing
Less W&F
Impose higher sanctions
Validator disclaims responsibility?
Enforcing
Warmer and fuzzier
Fewer sanctions for misuse
Validator has part of responsibility

27. The Time Dimension Continuity Depreciation
Staff change – handover process
Disaster recovery
Depreciation
Re-establish trust

28. The Warm and Fuzzy Feeling
Traceability
By DN
Via CA (usually)
Naming the subject
“Fuzzy matching”
Uniqueness of names

29. A Deo Rex, A Rege Lex
PMA CA RA
User

30. The Time Dimension
PMA CA RA
User
Revise
Implement
Re-check
Rekey

31. Compare WoTs We are more structured and hierarchical
Like CAs, really
Can we learn from WoTs?
Consequences of Type 1 Errors?
Consequences of Type 2 Errors?

32. Basic Exercises How many reviewers does it take to review a CA
How does this depend on their experience
Process developed as we go along

33. Basic Exercises
Would you trust my digital identity more if I had two, from different RAs (CAs)
Would you trust it more if verified by more than one RA?
How does this depend on the experience/training of the RA?

34. More Useful Exercises What are the goals we aim to achieve
Cf some previous soapboxen
Assurance
Writing up into the document currently known as “essentials”

35. Advanced Case Studies? The need to revet (re-vet) identities
Which time problem does it deal with?
How does it deal with it?
Are we solving a problem we don’t have
Or can be solved in a better way
Not enough things on top of other things
But too many carts before horses

36. Conclusion(s) Trust models operate with incomplete information
Implementations are (crude) approximations
Academic models of some use

37. Conclusions(s) Potential benefits from more complex trust models
Instead of solving the problem, identify the problem
Then (and only then) solve it