Subject: Spec. on QC-low-fat & QC-heavy-bio

From: Anders Rundgren <[email-masked]>
Date: Tue, 6 Apr 1999 13:35:47 +0200

Hi
on a considerably upgraded document (its predecessor has been floating
around before in this list) available at:

http://www.mobilephones-tng.com/papers/idcards.html

you will hopefully find some interesting stuff on how you in a practical way
can combine "low-fat" QCs  with their absolute opposite,
the "heavy" QCs with biometric information.

Note that the solution does NOT depend on
1) Out-of-band handling of biometric data (like mail attachments)
2) Directories holding biometric data  (with their associated privacy problems)
3) Cumbersome maintenance of local RP databases with biometric data.

And it keeps privacy in the hands of the user.  Where it should be.

Note that the specification targets an open environment rather than
the needs of an organizational PKI. 

This conceptual specification does not go into ASN.1 representations though.

[constructive] Criticism is welcomed!

Regards
Anders Rundgren

---

From: Stephen Kent <[email-masked]>
Date: Tue, 6 Apr 1999 10:58:20 -0400

Anders,

I visit your web site and reviewed the marketing white papers there.  One
feature of the system you propose, but that has not been mentioned before,
is that this proposal calls for users to cede control of certificates to a
server, which acts on their behalf.  The user employs one (local) cert to
authenticate himself to this server, and to direct it to act as his
intermediary.  This raises serious secruity issues, especially wrt
non-repudiation.

Steve