Subject: RE: Certificate / CPS issues

From: "Christian Huitema" <[email-masked]>
Date: Tue, 10 Jun 2003 09:12:01 -0700

> > I can not simply, they could be fake, and there
> > is no establishment of trust, especially if the
> > keystore component is written by Microsoft.
> 
> Why are keystore components written by Microsoft peculiarly unworthy
of
> trust?

The procedures used to determine the list of certification authorities
in Windows XP, Internet Explorer and other Microsoft products are
documented at:

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/secur
ity/news/rootcert.asp

-- Christian Huitema

---

From: John C Klensin <[email-masked]>
Date: Tue, 10 Jun 2003 17:53:46 -0400

--On Tuesday, 10 June, 2003 09:12 -0700 Christian Huitema 
<[email-masked]> wrote:

> The procedures used to determine the list of certification
> authorities in Windows XP, Internet Explorer and other
> Microsoft products are documented at:
>
> http://www.microsoft.com/technet/treeview/default.asp?url=/tec
> hnet/security/news/rootcert.asp

Christian,

Others may respond differently, but I found one part of this 
very interesting.  The text says, in part:

	When a user visits a secure Web site (that is, by using
	HTTPS), reads a secure e-mail (that is, S/MIME), or
	downloads an ActiveX control that uses a new root
	certificate, the Windows XP certificate chain
	verification software checks the appropriate Windows
	Update location and downloads the necessary root
	certificate. To the user, the experience is seamless.
	The user does not see any security dialog boxes or
	warnings. The download happens automatically, behind the
	scenes.

Suppose a user has sufficient expertise and desire to make 
individual evaluations of which CA certs to accept and from what 
CAs.  With the earlier model, she could look through the list, 
adding and deleting root certs according to her preferences and 
using Microsoft's acceptance of a given cert as a guide (to 
whatever extent she saw that as appropriate).  Now, if I read 
this correctly, there is no more choice: any cert accepted by 
Microsoft is automatically trusted by the desktop software and 
the user can't say, e.g., "I know that XYZ Corp, who met 
Microsoft's criteria, was just bought out by ABC Corp; I believe 
that ABC are scum and don't want to trust any cert issued by any 
subsidiary of theirs, even if it was issued pre-merger."

Conversely, if I'm part of an enterprise that issues its own 
certs for internal purposes, it doesn't look as if I can make 
those certs usable in the XP environment, since such internal 
certs don't satisfy the "broad business value to Microsoft 
platform customers" criterion and hence will not be accepted by 
Microsoft for use in the specified environment.

I hope this is only part of the story, and that user options to 
accept some certs (even if they are not accepted by Microsoft) 
and reject others (even if they are accepted by Microsoft) still 
exist in some usable form.

regards,
     john

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 11 Jun 2003 01:07:25 +0200

John writes:

> Now, if I read this correctly, there is no
> more choice ...

You read incorrectly.  Default behavior is not mandatory behavior.

> Conversely, if I'm part of an enterprise that
> issues its own certs for internal purposes, it
> doesn't look as if I can make those certs usable
> in the XP environment, since such internal

You read incorrectly, again.  You can add any certificates you want to your
machines.  You just can't get Microsoft to make them publicly available for
distribution by MS without convincing them that doing so is worthwhile for
Microsoft, which makes perfect sense.

> I hope this is only part of the story, and that
> user options to accept some certs (even if they are
> not accepted by Microsoft) and reject others (even
> if they are accepted by Microsoft) still

They do.  Look under Internet Options in Internet Explorer.

---

From: John C Klensin <[email-masked]>
Date: Tue, 10 Jun 2003 19:50:32 -0400

Anthony,

I asked Christian for a reason.  This appears to be relatively 
new. It isn't clear, from either the article or his note, how 
much of it  is deployed already.    It is linked, the article 
says, to Win XP and not to IE -- there are different procedures, 
it says, for IE under Win 2000, ME and earlier than are proposed 
(apparently going forward) for XP.  It strongly implies that, if 
there are options to control this, they are (will be?) Windows 
options, not (specifically) IE options (although IE might well 
be able to access them).    I don't have a copy of Win XP here, 
much less one with this kit installed, so I have no idea whether 
there is an easily-accessible option that permits turning "ask 
me before installing a cert" on, or what information that 
question provides.  The article might lead a reasonable person 
to believe that those things had been turned off, with no 
options available to the casual user, in the interest of a good 
user experience (something I can certainly make a case for, even 
while preferring that they not do it to me).   But, I don't 
know, which is why I asked.

And, unless you are in a position to speak authoritatively for 
Microsoft,...

    regards,
       john

--On Wednesday, 11 June, 2003 01:07 +0200 Anthony Atkielski 
<[email-masked]> wrote:

>> platform customers" criterion and hence will not be accepted
>> by Microsoft for use in the specified environment.
>
> You read incorrectly, again.  You can add any certificates you
> want to your machines.  You just can't get Microsoft to make
> them publicly available for distribution by MS without
> convincing them that doing so is worthwhile for Microsoft,
> which makes perfect sense.
>

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 11 Jun 2003 13:03:33 +0200

John writes:

> This appears to be relatively new.

The policies on shipping certificates with the product or making them
available via MS updates may be recent.  The mechanism of handling them in
software has been around for a long time.  You can see the certificates in
the Internet options in MSIE, and you can add or delete top-level CAs at
your discretion.  The current versions of MSIE and Windows ship with a
truckload of pre-loaded top-level CAs, I'm afraid.

> It isn't clear, from either the article or
> his note, how much of it is deployed already.

I see dozens of CAs defined in MSIE on XP and even on NT, so I'd say it is
well deployed.

> It is linked, the article says, to Win XP
> and not to IE -- there are different procedures,
> it says, for IE under Win 2000, ME and earlier
> than are proposed (apparently going forward)
> for XP.

XP has an auto update feature; that may be the difference.  They are all in
the Internet options dialog for configuration, however, as far as I know.

> It strongly implies that, if there are options
> to control this, they are (will be?) Windows
> options, not (specifically) IE options (although
> IE might well be able to access them).

Same thing, almost.  Calling up the Internet options from the Configuration
Panel in Windows brings up the same dialog as calling them up from MSIE or
Outlook Exprss.

> ... I have no idea whether there is an easily=
> accessible option that permits turning "ask
> me before installing a cert" on, or what
> information that question provides.

It hasn't often happened, but I seem to recall being asked if I wanted to
install a new top-level certificate.  You can examine the certificate before
approving it.

> And, unless you are in a position to speak
> authoritatively for Microsoft,...

Not anymore.