[saag] Re: Proposal for Discussion: The Secure Internet – Embedding Trust into the Protocol Layer

Thank you, Paul.


  1.  I am replying and add [email protected]<mailto:[email protected]>. I will resend to [email protected]<mailto:[email protected]> as well. Thanks.


  1.  Just a comment: our idea to eventually omit the certificate can be an option for the future. It’s not essential for the Live Key and mTLS.


Cheers

Thi Nguyen-Huu | CEO

Tel: +1 905.502.7000 x 3288  |  Toll Free: 888.879.5879
[email protected]<mailto:[email protected]> |  www.winmagic.com<http://www.winmagic.com/>

WinMagic Corp. | 11-80 Galaxy Blvd.
Toronto, ON  |  M9W 4Y8 |  Canada | www.winmagic.com<http://www.winmagic.com/>
[cid:[email protected]]<http://www.facebook.com/WinMagicInc>  [cid:[email protected]] <https://twitter.com/winmagic>   [cid:[email protected]] <http://www.linkedin.com/company/winmagic>   [cid:[email protected]] <https://www.winmagic.com/blog/>
[A person holding a phone and typing on a computer  AI-generated content may be incorrect.]<https://winmagic.com/en/secure_internet/>

From: Paul Wouters <[email protected]>
Sent: Tuesday, August 12, 2025 12:39 PM
To: Thi Nguyen-Huu <[email protected]>
Subject: Re: Proposal for Discussion: The Secure Internet – Embedding Trust into the Protocol Layer

You don't often get email from [email protected]<mailto:[email protected]>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
CAUTION:This email originated from outside of the organization. Do not click links, open attachments or respond unless you recognize the sender and know that the content is safe.


Hi Thi,

The Security Area Directors were forwarded this email.

Begin forwarded message:

From: "Thi Nguyen-Huu via RT" <[email protected]<mailto:[email protected]>>
Subject: Proposal for Discussion: The Secure Internet – Embedding Trust into the Protocol Layer
Date: August 11, 2025 at 3:51:53 PM PDT



Subject: Proposal for Discussion: The Secure Internet – Embedding Trust into the Protocol Layer



Dear IETF and W3C Working Group Members,



I’m writing to propose a discussion around a new architectural model we call The Secure Internet—a vision that reimagines how identity and trust are established online by embedding them directly into the transport layer.
the appropriate venue to discuss such items would be the SAAG mailing list of the IETF.


At the core of this model is a cryptographic identity signal called the Live Key, derived from the user presence, security posture and anchored in TPM hardware. This signal is long-lived, non-exportable, and accessible only when specific security conditions are met—such as active user’s OS login, full disk encryption, and up-to-date system patches. These conditions are policy-defined, allowing organizations to enforce dynamic, context-aware trust requirements beyond simple user presence.

Furthermore, the Live Key enables mutual TLS (mTLS) without requiring client-side certificates.
you will likely run into big resistance for the significant privacy risks associated with this proposal. but as I said, the proper discussion venue within the IETF for this would be the SAAG mailing list.

Paul, on behalf of the SEC Area Directors






Instead, the client registers its Live Key directly with the server, similar to the FIDO model. This simplifies trust establishment, eliminates the need for certificate authorities, and enables personalized, cryptographically assured sessions.

The Secure Internet aligns with the goals of both TLS and WebAuthn/FIDO2:

  *   It complements mTLS by enabling certificate-less client authentication.
  *   It enhances FIDO2 and Passkeys by offering a transport-level trust mechanism that can eliminate user interaction and additional policy-defined signals check while maintaining strong assurance.
  *   It inherently satisfies and exceeds NIST FAL3-level assurance without tokens, or channel binding. The architecture can eliminate the need for federated authentication entirely. In this model, the identity provider (IdP) evolves into a real-time, CA-like trust authority—capable of informing the relying party (service provider) when a previously registered public key is no longer trusted.

Importantly, this model does not require changes to existing standards—at least not initially. It builds on them, offering a new way to express identity and trust natively within the protocol layer. In the future, optional client certificates may be considered as part of evolving standards. We believe this approach could be of interest to working groups focused on TLS, OAuth, WebAuthn, and identity federation.

We would welcome the opportunity to present this concept, share open specifications, and explore how it might align with ongoing efforts across both IETF and W3C.

Thank you for your consideration.



PS. The same text is in the attachment. And for more info on our website please visit: https://winmagic.com/en/secure_internet/



Sincerely,



Thi Nguyen-Huu | CEO



Tel: +1 905.502.7000 x 3288  |  Toll Free: 888.879.5879
[email protected]<mailto:[email protected]> |  www.winmagic.com<http://www.winmagic.com/>



WinMagic Corp. | 11-80 Galaxy Blvd.

Toronto, ON  |  M9W 4Y8 |  Canada | www.winmagic.com<http://www.winmagic.com/>
[cid:[email protected]]


[cid:[email protected]]


[cid:[email protected]]


[cid:[email protected]]
[cid:[email protected]]

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]