Subject: Re: QC Sample Sucks (a bit)

From: Anders Rundgren <[email-masked]>
Date: Fri, 19 Mar 1999 09:17:15 +0100

Stefan (pardon the subject),

>Regarding biometrics:

>Anders suggests that the Qualified Certificate profile should include
>specific solutions for storing biometric data. I'm not so sure.

>First, this is already possible. You can:

>1) include biometric data or a hash of biometric data as a unique
>identifier stored in the dnQualifier.

Ooooooops!  That would be the absolutely last place in a QC where I would put
biometric data!   Why?

1. dnQualifiers will in REAL world implementations of QCs be holding a code
of some kind that uniquely identifies the person within the CA domain.
SSN, employment-code etc.

2. Hash of biometric data?  Biometrics are analog (inexact) objects that require
complicated pattern matching algorithms to be verified.  Regardless if it is a machine
or human that is doing the pattern matching they must be in clear.

>2) define a new attribute and include it in the structure.

Sure, but I am worried about the proliferation of non-standard extensions and
their interpretation.

>The problem of defining anything further in the profile is the lack of
>standards. You would anyway have to provide additional information in order
>to instruct the relying party how to use the data, so nothing would add to
>the existing possibilities.

Have you really investigated this?  Since there are quite a few products on the
market for biometric verification there may be some standards actually.

I know one STANDARD that I can give you right away:

Pictures (for a photo attribute and a handwritten signature attribute)

A picture would be a structure (my ASN.1 is not operational yet) of

    mime-type    (String)
    pictureblob    (Binary)

Every browser can support this!

>Secondly I don't believe that this widely asked for at this stage of
>evolution. Maybe something for the future when there are useful and
>standardized way to express biometrics and standardized way to make
>sensible use of the information stored in a certificate. Until then this
>will all be proprietary solutions used under locally defined conventions.

Almost every ID-card has a photo and signature and I have not heard that this has become
out of fashion.   Don't let QCs be limited by the SEIS or the German solutions, because their
solutions are their headache.

Anders
http://www.mobilephones-tng.com

---

From: Stephen Kent <[email-masked]>
Date: Fri, 19 Mar 1999 11:33:53 -0500

Anders,

<snip>

>Every browser can support this!

Well, if there was any doubt about your knowledge of ASN.1 or certificate
extension syntax I think it has been dispelled by your example :-).
Certificate extensions are NOT MIME types, and if one were to embed a
picture as an extension, it would not just be a binary blob, but rather
would use a format such as JPEG.

More to the point, I suspect that none of the mainstream browsers would do
anything useful with such an extension, irrespective of the obviously wrong
syntax.  The software in a browser that processes certs does not know how
to display or otherwise act upon an arbitrary extension.  This software is
separate from the HTML processing engine that does use MIME types and would
know how to diaplay a JPEG or similar encoded image. In most cases, you
would not be able to display such extentions as a user, just as most
browsers do not support display of all of the fields of current
certificates.

Steve