Subject: [KEYPROV] ISO's response to KEYPROV

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 1 Sep 2008 11:39:42 +0200

Key Provisioning is getting red-hot!
May the best man (or woman) win!

Anders Rundgren

----- Original Message ----- 
From: "Huehnlein, Detlef" <[email-masked]>
To: "Anders Rundgren" <[email-masked]>; <[email-masked]>
Sent: Monday, September 01, 2008 11:15
Subject: AW: [InteropEID] Key provisioning in mobile eIDs

Hallo Anders,

your mail is very interesting. The fragment below looks very
similar to what is about to be standardized in CEN 15480 and ISO/IEC 24727, which
is meant to work for any smart device (smart card, mobile phone etc.).
The standardized approach is somewhat more generic and extensible, but it seems to be
straightforward to map your structure to the standardized structures.

<CreateObject> -> <DIDCreate> (for PinCompare and Crypto Protocol)
<PUKPolicy>    -> <DIDMarker> for the PinCompare-Protocol
<KeyPair>      -> <DIDMarker> for the generic Crypto-Protocol
etc.

Why don't you want to use the standard?

BR,
  Detlef

> -----Ursprüngliche Nachricht-----
> Von: [email-masked]
> [mailto:[email-masked]] Im Auftrag von
> Anders Rundgren
> Gesendet: Montag, 1. September 2008 09:42
> An: [email-masked]
> Betreff: [InteropEID] Key provisioning in mobile eIDs
>
> F.Y.I.
> ----- Original Message -----
> From: Anders Rundgren
> To: [email-masked]
> Sent: Monday, September 01, 2008 09:30
> Subject: Replacement for generateCRMFrequest ()
>
>
> The following fragment of a coming XML-based provisioning
> scheme shows a somewhat extended generateCRMFrequest () where
> a PIN can span from 1 to n keys.   The example uses a shared
> (synchronized) PIN for multiple keys which is useful when you
> deploy PKI and OTP.  In addition there is an issuer-specified
> PUK as well (the encrypted value is in another section not
> shown for brevity).  Presumably you don't need to be an XML
> "guru" in order to digest the following lines:
>
>     <CreateObject>
>         <PUKPolicy Format="numeric" Hidden="true"
> RetryLimit="3" ValueReference="Item.1">
>             <PINPolicy Format="numeric" Grouping="shared"
> MaxLength="8" MinLength="4"
> PatternRestrictions="three-in-a-row sequence" RetryLimit="3">
>                 <KeyPair ID="Key.1" KeyUsage="universal">
>                     <RSA KeySize="2048"/>
>                 </KeyPair>
>                 <KeyPair ID="Key.2"
> KeyUsage="piggybacked-symmetric-key">
>                     <RSA KeySize="1024"/>
>                 </KeyPair>
>             </PINPolicy>
>         </PUKPolicy>
>     </CreateObject>
>
>
> The only real snag with this scheme is that it doesn't fit
> smart cards, but I anticipate that mobile phones will take
> their role since the latter combine HW-based cryptography
> (already featured in high-end Nokia phones) with powerful
> processors, displays, keyboards, extensive connectivity
> options, and Gb storage capabilities.  Yes, it would of
> course work with an extended soft token provider as well!
>
> Now to a problem regarding implementing this FireFox:  Recent
> versions of MSIE as well as Android's WebKit, have an
> advantage compared to Mozilla since they in reality offer a
> richer development platform due to the links to .NET and Java
> respectively.  I hope the Mozilla team some day consider
> adopting JSE or Mono as the foundation for extensibility
> rather than adding missing pieces like XML validation and
> security to the Mozilla core because the latter may turn out
> to be a dead-end.
>
> The current implementation plan is to add this in parallel to
> Mozilla's security architecture in the same way as some other
> Open Source groups have added support for Information Cards
> to Firefox.  Unfortunately it won't be able to support
> TLS-client-cert-auth but there is a replacement for that as
> well which is more in line with Information Cards; in fact
> the GUI is identical.
>
> In case you are interested in this work, just drop me a line.
>
> Anders Rundgren
> WebPKI.org
> _______________________________________________
> InteropEID mailing list
> [email-masked]
> http://lists.comune.grosseto.it/cgi-bin/mailman/listinfo/interopeid
>

_______________________________________________
KEYPROV mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/keyprov