Greetings,
I have been reviewing the SPKI drafts and trying to apply the concepts to a security model for SmartSockets (our message-oriented middleware product). I believe I have a fair grasp of the theory of operation, but I am wrestling with the practical considerations of implementing and deploying SPKI.
I hope that I might impose upon the members of this list to help enlighten me... :-)
First, my reading of the proposals would lead me to conclude that either a) authorization certificates are to be issued "on demand" when a user requires the authorization in question (and passes the scrutiny of the authorizing authority) or b) a user is likely to accumulate a fair number of authorization certificates, which she will have to store somewhere. SPKI could apparently support either model, but is one preferred over the other?
For the sake of discussion, let's call the first alternative the "ticket" security model and the second the "pass" model.
The pass model requires that certificates be stored somewhere. For existing applications like S/MIME this is typically on the user's local machine. But AFAIK there are no standards as to *where* on a machine a given users certificates might be found. (Well, Win32 has some standard certifate store functions-- but not other OSs.) Does SPKI presume that a common certificate store will eventually be widely supported? Or is it expected that each application will manage the storage of its own certificates, as is currently done? (If there is any work being done in this arena, I'd appreciate a pointer.)
With the ticket model, the local storage requirements are alleviated. But how does the service that issues ticket certificates keep track of authorizations? Might it aggregate pass-style certificates acquired from other sources, acting as a central store for them?
The second issue I'm grappling with is that "tuple reduction" combined with obtaining the necessary keys to validate all the signatures of the certificates involved in a particular access check is a non-trivial operation. Are we really to trust each individual application to implement this correctly? Or could this perhaps be delegated to a trusted service which implements checking in accordance with local policies?
The novel advantages of SPKI are quite apparent to me, but of course the devil is in the details of implementation...
--Kaelin Colclasure
Chief Architect
Talarian Corporation