® © 2003 Intel Corporation Security Issues with Names Carl Ellison Sr. Security Architect Network Architecture Lab Intel Corporation June 17, 2003

Network Architecture Lab © 2003 Intel Corporation 2 Ceremony ( = Protocol ) BCDA Alice Bob

Network Architecture Lab © 2003 Intel Corporation 3 Summary of the problem  Security depends in part on the accurate human use of the system.  When humans are objects in the system, they need to be named.  It is becoming common practice to use common names in these cases.  Programmers and humans use names in fundamentally different ways.

Network Architecture Lab © 2003 Intel Corporation 4 Programmer’s Use of Names  Names are unique (file, path, variable, URL)  sometimes globally  sometimes within some block or directory  The computer follows a name to the same object every time.  sometimes the wrong object, but that’s a bug  The computer executes immediately.  except perhaps with two-phase commit in transaction processing

Network Architecture Lab © 2003 Intel Corporation 5 Human’s Use of Names  The confusion over Dave was resolved by the end of the conversation.  The confusion itself served a useful purpose.  Natural language tolerates a great deal of ambiguity.  It also teaches humans to be sloppy in the use of names. What Dave Did

Network Architecture Lab © 2003 Intel Corporation 6 Sources of Failure  Programmers write code expecting computer-style processing of names.  They assume that also for human names processed by other humans.  By using human names in these UIs, they inadvertently invoke millennia of training to be sloppy in the use of names.  Then, when users exhibit that sloppiness, they blame the users.

Network Architecture Lab © 2003 Intel Corporation 7 Some Samples  John Wilson  John Wilson at the airport  Carl Carlson  Ann Harrison  David Nelson Lesson: People whose last names end in “son” are in trouble.

Network Architecture Lab © 2003 Intel Corporation 8 Why PGP > S/MIME  Certificate sent with the mail, in S/MIME  Some mailers display just the common name of the DN.  Humans would ignore everything else anyway.  PGP practice verifies incoming signatures against the local key ring and the key ring is filled only with personally verified certificates.

Network Architecture Lab © 2003 Intel Corporation 9 General Problems  ID PKI  Matt Blaze: “A commercial CA will protect you from anyone whose money it refuses to take.”  Corporate Authorization Directories

Network Architecture Lab © 2003 Intel Corporation 10 Solutions 1.Drop all names – but then what? 2.SDSI, EUDORA, PINE, … 3.Deferred Binding 4.???

Network Architecture Lab © 2003 Intel Corporation 11 Conclusion  Something must change.  The problem has been with us since at least the 1940’s, probably since the industrial revolution.  It’s getting worse, with the Internet.  Modern S/W techniques make it worse faster.  We need to find a way to solve this.