Subject: [KEYPROV] "Dumbed down" smart cards - Tokens of the future

From: Anders Rundgren <[email-masked]>
Date: Mon, 06 Sep 2010 22:35:59 +0200

In the mid 90'ties "client-server" was on the top of the Gartner hype curve.
A decade later the reality had replaced this vision with the new version 
of the "dumb terminal", the web browser.

What's strange is that the smart card industry not only clings to the 
generally flopped "client server" paradigm but also tries to expand it 
by making cards behave like web servers.

For authentication on the Internet you only need something really simple 
like a sub-sub-set of PKCS #11 which with no effort at all could be 
defined as a peripheral with a fixed interface which fits the dumb 
terminal concept as a glove.

The biggest change is that "dumb tokens" can be supported directly by 
platform vendors since the latter can reach all compliant ("moron") 
devices with a single and quite simple driver.

Unlike its smarter cousin, the "dumb token" has built-in support for 
swift and secure provisioning directly from a web browser.  It does not 
need any formatting or initialization either since it only deals with 
cryptographic objects rather than with applications or files.

Anders