Subject: RE: [dix] Proposed Charter for DIX Working Group

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 13 Jan 2006 08:18:22 -0800

The charter is somewhat more detailed than is usual.

I am not sure that the term 'identity' is going to be understood by
those who read it in the same sense as intended by those who wrote it.

I prefer to use the terms 'identifier' and assertions concerning an
identifier.

I would also suggest that the application in the blog world is
accountability based rather than permissions based.

As I see it the problem divides up into two major parts, authentication
and attributes.

I think that the DIX group should only address the authentication part.
There are already good standards based protocols for exchange of
attributes, SAML for example. I don't see any value to revisiting that
area, at the end of the day the issuer and the recipient of that
information will both have to implement code. It is a back end office
application that is going to require custom code whatever way you slice
it. 

If someone does think that there is a major technical advance possible
over SAML attribute assertions I would prefer to work that back into the
SAML spec (there is a WG still operating).

The other reason for avoiding attributes is that that is where all the
rat-holes lie. The Liberty org has spent years working up business rules
to govern transfer of personal data through closely coupled bilateral
agreements. The IETF is not a good venue for such discussions, it is a
technical organization, not a legal one.  

Where I think that we need to look at something different is on the
authentication side. SAML has an authentication mechanism but it does
not have quite the structure people seem to want to see.

In SAML the federation is closely coupled, it is assumed that there is
an a-priori federation agreement in place before the authentication
transaction takes place. At the time it seemed like this was the
inevitable, the correct approach. I now think that open federation is
possible and the way forward.

On the attributes side of thing I think that one of the points that has
to be made here is that a lot of the personal information that flies
around the web is not actualy needed at all. Publishers do not actually
care who reads their publication, it's the advertisers who care. And the
advertisers are in most cases looking to buy page views by particular
demographic groups rather than looking for detailed information.

The best way to get chartered to do the most urgent work is to propose
to address only the authentication component and state that the group
will rely on existing mechanisms (which do not even necessarily need to
be enumerated) to address attributes.

The problem as I see it in the federated identity space is that there is
no simple, open federation protocol that allows a user to easily use an
identity across multiple sites that do not have prior interchange
agreements (or rule book structure if you like) in place.

This is a very different application area to the one being considered by
Liberty. In bloggish applications I expect that the main application
will be simply the authentication component, laying claim to an
identifier.

The term 'simple' really needs to be qualified. Simple FOR WHOM?

For a project to succeed in this space it must not exceed the complexity
requirement of any party invovled. However the complexity requirements
of the different parties are very different:

	Authentication service provider (user's agent)
	Relying party (blogger)
	User

I believe that for a scheme to be successful the user experience myst be
dramatically simpler than any that has been proposed to date. In fact I
do not think that we can expect any mechanism that involves an
identifier that is any more complex than an email address is going to be
successful. 

Traditionally the approach has been to try to minimize complexity for
all parties, I think that this is a mistake. The parties responsible for
administering the scheme at blogs or at authentication service providers
are going to be several orders of magnitude more sophisticated than the
least sophisticated users.

The Internet has a billion users, the point of DIX is not to serve the
most sophisticated 10%, it is to serve the least sophisticated. I think
that it is well worth a marginal increase in sophistication on the
administrator side if we can reduce complexity for the end user.

The term 'secure' is going to get pounced on by the security people.
Don't be surprised if you are required to write a threat model. Although
the group is looking to be chartered in applications that will not stop
the security people weighing in. In fact it may well be considered that
the group should be under security.

The issue that is most likely to get pounced on here is the problem of
man in the middle and phishing attacks. The IETF has a policy that all
new protocol standards MUST NOT require en-clair password transmission.
I suspect in this case the bar will be higher and the group will be
required to produce a protocol that guarantees that the password is not
revealled to ANY party.

I think that this problem can be overcome but I have not yet completed
my own security analysis.

Finally I think that the charter must make clear that the protocol will
not involve the creation of any new registry. The Internet has one
federated namespace - the DNS. If DIX is to be an Internet protocol then
the federation must be based on the DNS, either explicitly or
implicitly.

The point here is enfranchisement and control, the whole rack of layer 9
issues that ICANN gets wrapped up in. To control your name on the
Internet you have to own the domain name you rely on. If your web site
is alice.blogsrus.com you are inevitably dependent on the continued
terms of service of whoever owns the name blogsrus.com.

To be an Internet citizen rather than a serf you have to own your own
domain name.

By implicit I mean a URI. The URIs used in YADIS/LID/OpenID/etc.
ultimately rely on the DNS. Whoever owns the embedded DNS name can
redefine the semantics for the rest of the name any way they like. From
a control point of view http://yadis.blogsrus.com/people/alice is simply
[email-masked] with more clutter. 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of John Merrells
> Sent: Thursday, January 12, 2006 10:41 PM
> To: [email-masked]
> Subject: [dix] Proposed Charter for DIX Working Group 
> 
> 
> Hello 'DIX mailing list member',
> 
> The following document is a proposed charter for a DIX Working Group.
> Feedback to me, or discussion on this list, is most welcome.
> 
> This proposed charter will form part of a request to the 
> application area directors for a BOF at the next IETF 
> meeting. At that meeting this charter will be discussed, and 
> if found to be acceptable, will become the working group 
> charter, should one be created.
> 
> John
> 
> -------------
> 
> Digital Identity Exchange - DIX
> 
> Chairs
> 
> TBD
> 
> Applciations Area Director(s):
> 
> Ted Hardie <[email-masked]>
> Scott Hollenbeck <[email-masked]>
> 
> Mailing Lists:
> 
> General Discussion: [email-masked]
> To Subscribe: [email-masked]
> In Body: In Body: subscribe
> Archive: http://www.ietf.org/mail-archive/web/dix/
> 
> Description of Working Group:
> 
> The DIX group will work on the specification of the Digital 
> Identity Exchange protocol. DIX is an Internet scale protocol 
> for exchanging identity information between endpoints. The 
> protocol architecture maintains a separation of control 
> between all parties of the exchange and supports both 
> compartmentalized and anonymous identities.
> 
> Problem Statement
> 
> The success of the Internet has led to a multitude of online 
> information sources and services. A consequence of this has 
> been the increasing demand for users to identify themselves 
> and to provide information about them. The user is currently 
> bearing the burden of managing their authentication 
> credentials and is repeatedly having to provide their 
> identity information. For example, signing in to web pages 
> and completing user registration forms.
> 
> An illustrative example would be a website that accepts user 
> generated content. A significant problem exists today that 
> these sites attract the attention of spammers. Upon 
> submission the site needs to determine both the identity of 
> the submitter and that they are of good standing in the 
> community. In other words, the site requires the reputation 
> of the submitter. This is not possible without a protocol to 
> identify a user across multiple sites and to move that 
> reputation data around.
> 
> Goal
> 
> The goal of this group is to specify a protocol for moving 
> identity information between parties and a system 
> architecture that enables the development of software agents 
> to manage a user's identity information.
> 
> Method
> 
> An identity information exchange should involve just three parties:  
> the user, their agent, and a relying party. The user's agent 
> is where they authenticate themselves and a repository where 
> they store their identity information, and the relying party 
> is an entity requesting identity information.
> 
> The protocol should be both simple and secure. Simple meaning 
> that minimal modifications should be required to the user's 
> software and the relying party's software to participate in 
> an identity information exchange. The protocol should be 
> inherently scalable, requiring no centralized services, 
> beyond those that already exist, in order to operate.
> 
> The security of a protocol is well understood within the IETF 
> to be the assurance of confidentiality and integrity of any 
> transferred information. But, in the context of digital 
> identity we wish to also be assured that user agents and 
> relying parties maintain user privacy.
> 
> Any solution should support multiple transport layers, but it 
> is anticipated that this working group will focus on a HTTP 
> based solution. In this case the user's software is a web 
> browser, to which no modifications should be required, and 
> the relying party would be a website. Continuing with the 
> theme of simplicity a website should require minimal changes 
> to support identity information exchange. For example, a web 
> form could receive information the same way that a user would 
> provide it, as if they typed it into the form themselves.
> 
> In moving identity information between parties it is expected 
> that the messages of the protocol will include elements that 
> bind property names and values to digital identities. How a 
> digital identity is referred to is an important 
> consideration. The properties an identifier could have are 
> that it allows the user to concurrently maintain multiple 
> personas, that it could allow for a separation between the 
> digital identity and the identifier and that it allow for 
> separation between the identifier and the user's agent. In 
> the interests of flexibility and interoperability we would 
> suggest that the identifier be a string of characters. This 
> working group may consider current best practice of what that 
> string might be. For example, a URL or a UUID.
> 
> 
> Work In Scope
> 
> A user-centric, simple, secure, interoperable protocol for 
> digital identity information exchange.
> 
> An advanced work item for this working group would be 
> consideration of how this protocol could operate over web 
> services protocols (e.g.  
> SOAP, XML-RPC, REST), or interoperate with existing web 
> services protocols for security information (e.g. WS-Trust). 
> The group must be careful not to preclude interoperation at a 
> later date.
> 
> Although the data that represents the identity information is 
> expected to be opaque it is worth mentioning that the data 
> could be raw attributes of the digital identity, or could be 
> third party claims. A third party claim is signed by an 
> authoritative source so that the relying party can be assured 
> of its authenticity. The benefit of third party claims, as 
> supported by this protocol, is that the separation of claim 
> acquisition from claim presentation provides both scalability 
> and privacy benefits.
> 
> Out of Scope
> 
> How to federate identity namespaces.
> How to manage digital certificates or certification authorities.
> The mechanisms by which authentication and authorization are 
> performed.
> 
> Goals and Milestones:
> 
> March 2006 - BOF meeting
> June 2006 - First DIX Protocol Internet Draft June 2006 - 
> First DIX HTTP Transport Binding Internet Draft July 2006 - 
> Working Group meeting November 2006 - Working Group meeting 
> December 2006 - Request Last Call for DIX Protocol December 
> 2006 - Request Last Call for DIX HTTP Transport Binding March 
> 2007 - Working Group meeting April 2007 - Submit DIX Protocol 
> to IESG for consideration as Proposed Standard April 2007 - 
> Submit DIX HTTP Transport Binding to IESG for consideration 
> as Proposed Standard
> 
> 
> 
> 
> _______________________________________________
> dix mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dix
> 
> 

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: John Merrells <[email-masked]>
Date: Fri, 13 Jan 2006 13:23:10 -0800

> The charter is somewhat more detailed than is usual.

Yes... because of the topic, 'identity', I wanted to scope the
work down as clearly as possible.

> those who read it in the same sense as intended by those who wrote it.

What did it mean to you when you read it? My understanding,
and I think the general understanding, is that 'identity' is a thing
that a person has.

> I prefer to use the terms 'identifier' and assertions concerning an

And, I think that 'an identity is identified by an identifier'... and
that 'attributes are bound to identifiers by assertions'.

> accountability based rather than permissions based.

I think that the user-generated content spam problem is
similar to the email spam problem. Initial solutions were
based on content analysis, but they have been defeated.
There are now efforts afoot to identify the sender of an
email, so that the reputation of the sender can be
determined. 'Is the sender a good netizen?' The same
problem exists for user-generated content. So, I believe
that identity leads to reputation rather than to accountability
or authorization.

> application that is going to require custom code whatever way you  

Our thinking is that DIX provides a mechanism for moving attribute
assertions... those assertions could be about authentication or about
attribute values... and they could be presented as plain text, or as
XML, or as SAML, or whatever the endpoints agree to exchange.

> technical organization, not a legal one.

I'm in total agreement. We don't want to go down that rat-hole. We
have limited the scope to how the user moves their own identity
information from their agent to a relying party.

> not have quite the structure people seem to want to see.

In the charter we've clearly stated that authentication mechanisms
are out of scope. The agent can authenticate the user in any way
it choses, and the relying party can chose whether to accept that
authentication or not. DIX just moves the authentication assertion.

> agreements (or rule book structure if you like) in place.

Yes, that's one of the things that's motivating this user-centric
identity movement.

> will be simply the authentication component, laying claim to an

Note that that's just one example of many.

Also that there is useful identity information associated with users
in the blogosphere. My icon for instance. These days every blog
or 'web2.0' website requests a URL to an image of me. It's making
the web a friendlier place :-)

> The term 'simple' really needs to be qualified. Simple FOR WHOM?

Good point. Perhaps I should have elaborated on that. In order
of importance...

1) The end user - easy to adopt, easy to use.
2) The relying party - easy to enable a site, easy to deploy.
3) The agent - all complexity is pushed to these guys.

> administrator side if we can reduce complexity for the end user.

Yeah, couldn't agree more.

> the group should be under security.

Yes... good advice.

> the federation must be based on the DNS, either explicitly or

Yeah. The proposed charter states this:

'The protocol should be inherently scalable, requiring no centralized
services, beyond those that already exist, in order to operate.'

Perhaps oblique, but I meant what you said 'DNS'.

Thanks for your illuminating comments.

John