[OTAS-Planning]Inter-node Authentication

[Adam J. P. Wood]

In the little free time I've had recently I've been thinking about the
security of the OTAS software. The e-mail is a bit long but I hope that makes
it easier to follow step by step.

I think we have 2 different needs within the system.
1) There are the control protocols which nodes can use to communicate with
each other. These protocols handle things such as passing public certificates
around securely, registering a node's functions and the messages it can
handle. Perhaps even so far as allow inter node "chat" (not in an instant
message with emoticons type of way, more like secure communications) and log
file checking. There are more here but I'm not finished thinking about them
by a long way and I'll need everyone else's input on these.
This type of communication is unique between individual peers and not shared,
it also will often be sensitive information. I propose we use an
authenticated and encrypted channel for this. This allows us to securely and
accurately identify nodes joining the group, assign them a unique identifier,
check the certificate and perhaps most importantly, notify a new node of any
certificates we have to revoke from now untrustworthy members.
This communication must be direct node-to-node!

2) Only a few nodes will be communicating as described above, the rest will
happily sit on the network and relay earthquake data. Each node would
therefore have open channels and send signed messages to other interested and
connected nodes.
This type of message passing could be between any nodes. Some nodes might not
even generate or use messages, just passing them along to others. A message
from point A that is of interest to point B might pass through C, D, and E
before reaching an interested node but as long as the message is signed
properly it can still be trusted.

Here's an example using names from the list as reference points:

------------------EXAMPLE-------------------------------
a) Jose runs a node calculating the hypocentre of an earthquake, either by
using raw data or scraping the information from the USGS site.

b) Brian runs a node which takes the hypocentre and calculates the origin of a
tsunami.

c) Ben runs a node which takes the origin of a tsunami and calculates the
impact that will be seen in Indonesia.

d) Adam runs a nod that warns the inhabitants of Aceh if OTAS thinks there
will be a tsunami.

All of these nodes are interconnected (probably with many others too). On
start up only Jose has a certificate that we ALL trust. Jose also trusts
everyone listed above. Each node becomes part of the network and identifies
itself with Jose since we trust him.

Brian uses a secure channel to tell Jose that he would like any hypocentral
data that Jose can supply. Jose acknowledges that he can supply this.

Ben contacts as many peers as possible and asks for tsunami origin info. One
of those contacted will be Jose, since Jose can't supply this he passes back
to Ben the public key certificate for Brian who can fulfil this request. Ben
then repeats with Brian's node and can start receiving tsunami origin data in
the clear. One of the other peers contacted might have tsunami origin info
but until we receive a key from a trusted source or enter it manually we
can't be sure of the accuracy.

Ben's trust of Brian is assumed because Jose is trusted, we need to decide how
much trust can be passed along in such a way.

Brian contacts Ben and delivers a message signed by himself and by Jose. Ben
knows to trust this message since he can confirm where it has come from and
the whole trail back to where it started. If Ben receives another message
signed only by Brian and an unknown node he should either ignore it or try to
contact other peers to confirm authenticity.

When the Internet suffers a technical problem and Ben is unable to "see"
Brian, other nodes in the p2p group will pass the message along by other
channels. Since the message has been signed by Brian and by Jose the actual
node that delivers the message is unimportant. We know the message contents
are still accurate.

Things will get more complicated the more "hops" we are away from our most
trusted node. For example when Adam is told to send a warning by Ben, the
message will be signed by Jose, Brian and Ben. Since Adam has never had
contact with Brian we should get his public key before trusting the message
(at least before we trust it completely). So Adam contacts all his trusted
nodes over a secure channel asking for Brian's key. Not to hard to get and
then we have a full chain of trust back to the source. Obviously these keys
only need to be passed around the first time.

The trust relationships might be quite complex but shouldn't be too hard to
figure out. Using a system like this keeps the need for encrypted messages
down to a minimum and without time constraints, while allowing fast message
passing in the clear and still being able to authenticate those message
despite coming from any number of sources.
----------------------------------END OF EXAMPLE-----------------------------

I've got some ideas on message structure and node architecture too but I'll
wait for a few people to shoot holes in the ideas above first so we can
refine or throw that out before thinking about too many aspects of the
system.

Adam

[Brian Butcher]

As with a lot of abstraction at this level, I may not have understood exactly
what you are aiming at.

A 'top' down authentication system defeats the object of a peer to peer system
as the peers will not be able to connect if the top of the authentication
pyramid fails. It seems to me that you are trying to overcome this known
weakness by applying simultaneously a system where most of the peers have
access to most of the keys certificates of most of their peers.

Doesn't possession of all these key certificates leave room for mischief?
Wouldn't it be possible for a peer to pass on duff certificates and use the
genuine ones for its own mischievous purposes.

My major doubt about this authenticating authority is more about human
problems than technical problems. Following your example, with Jose as the
sole authenticating authority. How many committee meetings, draft treaties,
concords, agreements, letters of intent, and 'meetings of the full council'
might it require to get recognition to Jose's authority?

Worse still the Jose has to maintain support after he has made some difficult
decisions. Suppose the island of 'Ballyhigh' requested membership of the OTAS
network as a primary source. 'Ballyhigh' is a Pacific atoll situated close to
a region of known seismic activity. It has a population of 200, but USIS
believe the population is growing rapidly with student at several newly
opened Madrasas. The island has its own oceanographic station, with its own
tsunami wave detection hardware, financed largely with a grant from the
Democratic Republic of China. (Formosa) There are one or two scientists from
the Democratic Republic of China working on Ballyhigh.

Decisions about the trustworthiness of the Ballyhigh oceanographic observatory
would be almost entirely political. Whatever Jose did of said about that
particular application would provoke some disagreement at least.

For me the strength of the OTAS idea is that it might keep away from any of
the political activity about centralised organisations, particularly in the
developing world.

Isn't the proposed scheme rather complicated. So far every simple part of OTAS
I've looked at has turned out to be more complex than I'd expected. This idea
seems complex to start with!

Brian

[Adam J. P. Wood]

Brief comments inline, maybe more later if I get time and this doesn't clear
things up.

Post by Brian Butcher
As with a lot of abstraction at this level, I may not have understood
exactly what you are aiming at.
A 'top' down authentication system defeats the object of a peer to peer
system as the peers will not be able to connect if the top of the
authentication pyramid fails. It seems to me that you are trying to
overcome this known weakness by applying simultaneously a system where most
of the peers have access to most of the keys certificates of most of their
peers.

Access to as many keys as they need yes. As for defeating the object of a peer
to peer arrangement, I disagree. The peer to peer network runs along side the
authentication, we just use the authentication to be sure of the contents of
what we receive.

Remember, authentication can even be performed offline by meeting someone
physically and exchanging keys if that's the level of trust you want to go
for. Only the transmission of Event Messages needs to be done in realtime
with network outage reliablity. The point is that they are not reliant upon
each other, just our decision on what to do with a message we receive is
dependent upon our trust of the source.

Post by Brian Butcher
Doesn't possession of all these key certificates leave room for mischief?
Wouldn't it be possible for a peer to pass on duff certificates and use the
genuine ones for its own mischievous purposes.

A malicious node would not be able to sign the duff certificate before passing
it on. So you would know it has not come from the source you expected. That's
the whole point. If a private key did get released by accident we can revoke
it and issue a new one.

Post by Brian Butcher
My major doubt about this authenticating authority is more about human
problems than technical problems. Following your example, with Jose as the
sole authenticating authority. How many committee meetings, draft treaties,
concords, agreements, letters of intent, and 'meetings of the full council'
might it require to get recognition to Jose's authority?

In my example there were also only 3 peers besides Jose. In a real world app
we would have lots more nodes and many of them might be certificate issuers.
This brings in your point below about political pressures. There is no reason
that another set of nodes couldn't run alongside my example with completely
different perspectives on trust.

As for amount of 'red tape' before you can recognise a node's authority, that
is up to the individual running a node. You can enter as few or as many root
authorities as you like. It's no different to when you visit a https:// site
and accept the certificate there.

Post by Brian Butcher
Worse still the Jose has to maintain support after he has made some
difficult decisions. Suppose the island of 'Ballyhigh' requested membership
of the OTAS network as a primary source. 'Ballyhigh' is a Pacific atoll
situated close to a region of known seismic activity. It has a population
of 200, but USIS believe the population is growing rapidly with student at
several newly opened Madrasas. The island has its own oceanographic
station, with its own tsunami wave detection hardware, financed largely
with a grant from the Democratic Republic of China. (Formosa) There are one
or two scientists from the Democratic Republic of China working on
Ballyhigh.
Decisions about the trustworthiness of the Ballyhigh oceanographic
observatory would be almost entirely political. Whatever Jose did of said
about that particular application would provoke some disagreement at least.

Like I said above another node could also be a certificate issuer. In a
situation like this the Ballyhigh oceanographic observatory could sign their
own certificates and anyone on the island could enter this as a 'root
authority'. You and I need not trust them but that doesn't stop anyone else
from doing so. We could even pass their messages around but never use the
contents because it comes from a source we don't trust. Now if Ballyhigh want
to trust Jose's messages then they have more data to work with for double
checking calcluations. Trust does not need to be symmetric. Also, certificate
issuers don't need to be in the top layer. They can exist in any layer.

Post by Brian Butcher
For me the strength of the OTAS idea is that it might keep away from any of
the political activity about centralised organisations, particularly in the
developing world.

I agree 100%. That doesn't mean that I automatically trust everyone out there
though, nor should they trust me. We might each trust a third party which
would help expand our own networks. At the end of the day there is a trust
relationship one way or another, the scheme I'm proposing brings that to the
surface and let's us customise it and not assume everyone is worth listening
to.

Post by Brian Butcher
Isn't the proposed scheme rather complicated. So far every simple part of
OTAS I've looked at has turned out to be more complex than I'd expected.
This idea seems complex to start with!
Brian

One last point, even if we drop the p2p idea we still need to authenticate
every message coming in. If anyone has any better ideas on how to do this I
think now's the time to speak up.

I hope that has confused everyone even more ;-)

Adam