Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are we self-sovereign PKI yet?

buffrr.dev

Post reply on HN
Print view View original

31–40 of 92 posts

Re: Are we self-sovereign PKI yet?

#31

Post by sabedevops »

lrvick wrote: post #13

Everyone is trying so hard to re-invent PGP, while parroting that PGP is dead because some security influencers said so. Well, there is a LOT of ongoing PGP modernization work on both specifications and implementations in recent years and my team and I at Distrust will be publishing a writeup on it any day now, as well as organizing yet another key generation and signing party in San Francisco next month. PGP is not…

I've struggled with PGP with the idea that I can't quite express "I'm signing as this specific User ID by using this specific signing subkey"... The only way I've found to reliably express that is to maintain completely separate keys. Is there anything in the works to give ergonomics around this?

Re: Are we self-sovereign PKI yet?

#32

Post by Terr_ »

lxgr wrote: post #2

Great concise description of the problem. As for the solution, it seems to explicitly not address recovery of lost keys/identities, which is however exactly the part that makes this hard for regular users. That, and general name confusion attacks, I suppose: "I'm lxgr17@key, yeah, don't ask about the first 16. Oh also make sure 'key' is not the one with the Georgian lowercase e in the middle, that one's an impostor.…

It's interesting to imagine how different the security landscape would be if human brains could easily transcribe a smallish quantity of high-value bits [0] and then compare two versions for exact equality.

I think the exact and trusted data-movement is the hard part. If we could instantly transcribe a 150 digit number (~512 bits) from eye to fingertips, then the actual memory/comparison could be done in any pocket-calculator, with X-Y==0.

Re: Are we self-sovereign PKI yet?

#33

Post by tptacek »

lxgr wrote: post #2

Great concise description of the problem. As for the solution, it seems to explicitly not address recovery of lost keys/identities, which is however exactly the part that makes this hard for regular users. That, and general name confusion attacks, I suppose: "I'm lxgr17@key, yeah, don't ask about the first 16. Oh also make sure 'key' is not the one with the Georgian lowercase e in the middle, that one's an impostor.…

It's not "hard" for regular users; it's a complete non-starter for regular users. Every "non-custodial" or "self-sovereign" system of trusted identities founders on this issue: account recovery is the hardest problem in identity, and if you don't have a solution for it, your system is going to be a niche at best.

People have been coming up with these schemes for decades, and for that entire time, the near-universal de facto standard trusted identity system has been "Google accounts". People knew at the beginning that they were delegating trust to Google; they know it now as well; they are not going to adopt "names resolve to a key, the same key, in every application", no matter how many different names that scheme is given.

Re: Are we self-sovereign PKI yet?

#34

Post by purplehat_ »

noman-land wrote: post #29
lrvick wrote: post #13

Everyone is trying so hard to re-invent PGP, while parroting that PGP is dead because some security influencers said so. Well, there is a LOT of ongoing PGP modernization work on both specifications and implementations in recent years and my team and I at Distrust will be publishing a writeup on it any day now, as well as organizing yet another key generation and signing party in San Francisco next month. PGP is not…

One thing I don't like about key signing is that 1. You reveal your social graph 2. Different instances of the key can be differently signed For someone to sign your key that information has to be stored on your key or in a central location.

The first bit seems possibly solvable with private set intersection. You can publish a salted hash of everybody you trust, and I can compute hashes of everyone I trust with your salt to see if we have anyone in common. Then I check the signature corresponding to the salted hash I like, and hopefully it doesn't reveal anything you don't want to reveal.

I don't know if anyone has actually done this in practice. Does it work?

Re: Are we self-sovereign PKI yet?

#35

Post by tptacek »

lrvick wrote: post #13

Everyone is trying so hard to re-invent PGP, while parroting that PGP is dead because some security influencers said so. Well, there is a LOT of ongoing PGP modernization work on both specifications and implementations in recent years and my team and I at Distrust will be publishing a writeup on it any day now, as well as organizing yet another key generation and signing party in San Francisco next month. PGP is not…

No part of what's being proposed here has anything to do with PGP. They aren't proposing a "web of trust" with "key servers". They're proposing an immutable binding between names and key identities.

PGP's "self-sovereignty" comes from mutually agreeing with groups of people who already know each other to exchange files establishing identities. That is to trusted identity what the one time pad is to cryptography: a punt on the entire problem space.

Re: Are we self-sovereign PKI yet?

#36

Post by lrvick »

purplehat_ wrote: post #34
noman-land wrote: post #29

Earlier quoted context omitted.

One thing I don't like about key signing is that 1. You reveal your social graph 2. Different instances of the key can be differently signed For someone to sign your key that information has to be stored on your key or in a central location.

The first bit seems possibly solvable with private set intersection. You can publish a salted hash of everybody you trust, and I can compute hashes of everyone I trust with your salt to see if we have anyone in common. Then I check the signature corresponding to the salted hash I like, and hopefully it doesn't reveal anything you don't want to reveal. I don't know if anyone has actually done this in practice. Does it…

Having a public graph is critical for trust in Linux distributions. All it means is a human met you and agreed you are human and signed your key. It does not imply you are friends.

It is pretty useful for someone totally outside the trust graph to be able to prove the key that just signed the latest release of stagex is only a couple steps away from the keys that sign debian and the Linux kernel. Keys that long predate AI.

Public trust accountability is exactly what we want from people responsible for the legos that make up the internet.

You can of course have private signature packets revealed as needed though.

Re: Are we self-sovereign PKI yet?

#37

Post by lrvick »

growse wrote: post #25
Grosvenor wrote: post #23

Earlier quoted context omitted.

No one. The influencers are simply telling you you're wrong if you think you need that. Which is the thing, we do need a single key that can be used for all those things. So we get PGP.

> No one. I thought everyone was "trying so hard to re-invent PGP". > we do need a single key that can be used for all those things We do? This is not obvious. Why does my disk encryption key need to be the same that I use to sign binaries that I release?

It is hard enough for people to keep up with one keychain, let alone a dozen of them for every use case in their lives.

PGP keychains allow you to have a single 24 word mnemonic seed to recover your entire digital identity, data access, etc. The UX is strictly better than the commonly suggested hodge podge of flavor of the week alternatives.

Standards make interoperability a lot easier.

Re: Are we self-sovereign PKI yet?

#38

Post by lrvick »

sabedevops wrote: post #31
lrvick wrote: post #13

Everyone is trying so hard to re-invent PGP, while parroting that PGP is dead because some security influencers said so. Well, there is a LOT of ongoing PGP modernization work on both specifications and implementations in recent years and my team and I at Distrust will be publishing a writeup on it any day now, as well as organizing yet another key generation and signing party in San Francisco next month. PGP is not…

I've struggled with PGP with the idea that I can't quite express "I'm signing as this specific User ID by using this specific signing subkey"... The only way I've found to reliably express that is to maintain completely separate keys. Is there anything in the works to give ergonomics around this?

You should only be signing other peoples keys with your master key which should never touch an internet connected operating system. Subkeys should have limited privileges and be easy to lose or rotate as needed, but can all live under the same master offline identity key, which acts like a personal CA.

Re: Are we self-sovereign PKI yet?

#39

Post by lrvick »

tptacek wrote: post #35
lrvick wrote: post #13

Everyone is trying so hard to re-invent PGP, while parroting that PGP is dead because some security influencers said so. Well, there is a LOT of ongoing PGP modernization work on both specifications and implementations in recent years and my team and I at Distrust will be publishing a writeup on it any day now, as well as organizing yet another key generation and signing party in San Francisco next month. PGP is not…

No part of what's being proposed here has anything to do with PGP. They aren't proposing a "web of trust" with "key servers". They're proposing an immutable binding between names and key identities. PGP's "self-sovereignty" comes from mutually agreeing with groups of people who already know each other to exchange files establishing identities. That is to trusted identity what the one time pad is to cryptography: a pu…

> PGP's "self-sovereignty" comes from mutually agreeing with groups of people who already know each other to exchange files establishing identities.

Or between total strangers that met in person at a key signing party and agreed "you look like a human and not a bot to me".

We need human identity to be certified by humans using very long lived standard PKI primitives. Anything else, bots can easily monopolize to the point of being useless.

Rather than debate this here though yet again, I am working on a blog post which includes a lot of quotes, including one from you, to make a case for why PGP is still the best and most widely used and useful proof-of-human and self-sovereign PKI solution that exists, and why we should double down on it.

That comment thread is sure to be interesting.

Re: Are we self-sovereign PKI yet?

#40

Post by tptacek »

lrvick wrote: post #39
tptacek wrote: post #35

Earlier quoted context omitted.

No part of what's being proposed here has anything to do with PGP. They aren't proposing a "web of trust" with "key servers". They're proposing an immutable binding between names and key identities. PGP's "self-sovereignty" comes from mutually agreeing with groups of people who already know each other to exchange files establishing identities. That is to trusted identity what the one time pad is to cryptography: a pu…

> PGP's "self-sovereignty" comes from mutually agreeing with groups of people who already know each other to exchange files establishing identities. Or between total strangers that met in person at a key signing party and agreed "you look like a human and not a bot to me". We need human identity to be certified by humans using very long lived standard PKI primitives. Anything else, bots can easily monopolize to the p…

That's fine! It's perfectly reasonable to say "this isn't a problem worth solving". But you can't then say something else actually solves the problem by punting on it. Be clearer about what you're saying, instead of invoking the specter of "security influencers".
Post reply on HN