Subject: [dane] Eccentric Authentication, a DANE application

From: Guido Witmond <[email-masked]>
Date: Fri, 07 Jun 2013 18:47:38 +0200

Dear readers,

I've been designing a protocol and writing some code to create anonymous 
client certificates easily.

In brief:

Each website operator that wants to get rid of passwords can deploy a 
local CA to sign its users' client certificates. It signs only for his 
own clients. The site does not trust any other CA for client certificates.

Users are free to choose their own account name. We store it in the 
certificate Common Name at certification time. Lazy users just ask their 
user agent to come up with a long random number.

There is one requirement, each Common name must be unique. To verify 
that each user publishes his certificate at a global registry.

By tying the RootCA certificate in DNSSEC with DANE, the local (self 
signed) Root certificate becomes the *verifiable identity* of the web 
site. Only the site operator and a few domain registry people are able 
to change that. A change that will not go unnoticed with the global 
registry.

The benefits are great:

The customers (user agent) can verify the identity of the site before 
loggin in with the client certificate for that site. This prevents MitM 
attacks.

The customer stays anonymous for as long as he wants.

The site can send encrypted messages to the customers. And back.

The users can send encrypted messages amongst each other (when the site 
does the message transfer) or the users use independent channels.

Demo

I have a demo site and the software to download:

http://eccentric-authentication.org/blog/2013/06/07/run-it-yourself.html

Regards, Guido Witmond.