Subject: RE: QC Sample Sucks (a bit)

From: Anders Rundgren <[email-masked]>
Date: Fri, 19 Mar 1999 07:54:50 +0100

Stephen,
>Wrong, ID-certificates containing hard (SSNs, Biometrics) information should
>NEVER be transmitted in clear.  Although PKI stands for PUBLIC Key
>Infrastructure,
>this cannot (should not at least) be interpreted as public for anybody.
>Just to your own selection of trusted RPs.

Well, if you plan on making use of a growing installed base of products
designed for general X.509 certificate use, this assumption will not be
true, although I agree that one COULD provide better protection with a
different set of applications, etc.

I consider current off-the shelf products as mostly intended for closed organizational
PKIs.  I think that ID-card programs will in most case be made of a mixture of commercial
and customized components.  Such system fortunately do not suffer from any installed
base of anything currently.

>This is solved by only letting such certificates be fetched from the CA by
>the OWNER using a
>"light" certificate.  Naturally using strong authentication/encryption.
>The private/public keys
>can be the same for the "heavy" ID to eliminate unnecessary key distribution

>From a CA?  CA's do not necessarily store certs for retrieval by clients.
Directories do this, and I have relatively little confidence in the
assurance of the confidentiality offered by directory products.

Well, market will tell.
IMO fetching special certs as described above from an ID CA is a VERY useful idea that
is bound to happen. 

Anders
http://www.mobilephones-tng.com

---

From: Stephen Kent <[email-masked]>
Date: Fri, 19 Mar 1999 11:22:12 -0500

Anders,

>base of anything currently.

Perhpas I'm not being clear.  An organizational PKI built from standard,
commercial CA, directory, and application components generally will not
offer much in the way of confidentiality for certificates, because the
standards these components are built to do not call for such security
services.

>IMO fetching special certs as described above from an ID CA is a VERY

Well, as CTO of a major CA service and technology provider, I can say that
we support CA export of certs and CRLs to a directory.  We don't couple the
directory too tightly to the CA, as that would often decrease the security
of the CA.  We work with directory providers to ensure compataible data
transfer, but otherwise keep the notions of CA and directory quite separate.