PorKI: Making User PKI Safe on Machines of Heterogeneous Trustworthiness

Abstract

As evidenced by the proliferation of phishing attacks and keystroke loggers, we know that human beings are not wellequipped to make trust decisions about when to use their passwords or other personal credentials. Public key cryptography can reduce this risk of attack, because authentication using PKI is designed to not give away sensitive data. However, using private keys on standard platforms exposes the user to "keyjacking"; mobile users wishing to use keypairs on an unfamiliar and potentially untrusted workstation face even more obstacles.In this paper we present the design and prototype of PorKI, a software application for mobile devices that offers an alternative solution to the portable key problem. Through the use of temporary keypairs, proxy certificates, and wireless protocols, PorKI enables a user to employ her PKI credentials on any Bluetoothenabled workstation, including those not part of her organization's network, and even those that might be malicious. Moreover, by crafting XACML policy statements that limit the key usage to the workstation's trustworthiness level, and inserting these statements into extensions of the proxy certificates, PorKI provides the user or the relying party with the ability to limit the amount of trust that can be put in the temporary keypair used on that workstation, and thus the scope of a potential compromise.

Trustworthy and personalized computing on public kiosks

“…Sinclair and Smith [27] propose that a phone, in possession of a sensitive private key, temporarily delegate authority to a short-lived keypair known to the kiosk. The trustworthiness of this kiosk is explicitly encoded in a credential signed by the system administrator.…”

An Improved Wireless Grid Security Infrastructure Based on Trusted Computing Technology

“…In grid field, a delegation mechanism named MyProxy [7] is proposed. In [8], a PorKI for PKI's mobility have been proposed. Compared with our work, most of researches related with mobility of grid based on trusted hardware have not focused on wireless environment problem.…”

PorKI: Portable PKI Credentials via Proxy Certificates

“…This is a brief overview of related work; for a more complete treatment, see the earlier paper on the design of PorKI [14].…”

“…To transfer the shared device's trust measurement and the proxy credentials back to the shared device, PorKI needs a secured communication channel between the two devices. In our previous work [14], we focused on the usage of bluetooth [1] as the out-of-band channel for transferring the user's proxy credentials, but this proved to be too restrictive as most of the shared resources (eg., desktop computers) do not come with bluetooth capabilities. Therefore, we divided the pairing process into two separate phases.…”