Subject: Re: A $25,000,000,000 PKI Was:Spec. on QC-low-fat & QC-heavy-bio

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 8 Apr 1999 07:14:50 +0100

Steve,

>I know a numnber of reasons why SET has not been accepted in the U.S., if
>that's the context you're citing, and they are largely independent of the
>issues you cite.  For example, U.S. consumer protection laws make the
>advantages of SET over simple use of SSL and a credit card number
>unattractive to users.

You are absolute right. SET is a European problem currently.

> Since most online merchants can make a fair amount
>of money despite the security limitations (e.g., lack of origin
>non-repudaition) of the current paradigm, there is insufficient motivation
>for them to change to SET.

Right.

>Since most of the purchases over the web are
>done from PCs, the thin n client argument is not relevant.

That is true for the current situation - not for the mobile future though.

Hum, maybe you should take a look on GlobeSet's (a leader in SET) ServerWallet
and see why the developed it.  

>All of our employees have computers, those who travel have laptops.  Not
>all have cell phones.  of the ones that do have cell phones, few would be
>capable opf making use of the certs you describe, i.e., not many are PCS
>phones.

Sure, but I am talking about the year 2003 or so. 

>The solution you propose is definately NOT high quality.

By design?  I am fully convinced (not such a big surprise though :-))  that if
the CyberPhone concept and associated server technology is developed by the best brains
in the industry it could match any quality standards.  Regarding the security model
it is not so far from a PKI-only version of Kerberos which seems to be higly
regarded by security people.

>It is an effort to
>take advantage of devices with limited capabilities, and skew security
>design principles to accommodate these limitations.

CyberPhone does a LOT more than address devices with limited capabilities.
It also addresses certificate management, traceability and transaction logging, 
business transaction models, and last but not least end-user security including
resource loss, revocation, backup and recovery.

<snip>

Regards
Anders
http://www.mobilephones-tng.com

---

From: Stephen Kent <[email-masked]>
Date: Thu, 8 Apr 1999 20:22:59 -0400

Anders,

<snip>

Well, at least we agreed on much of the SET stuff.

>That is true for the current situation - not for the mobile future though.

Maybe I should call the cell phone an anexoric client, not just a thin
client :-).  Advocates of other approaches to mobility assumje more
powerful computation bases, as we discussed earlier.  The cell phone (PCS)
is one, speculative approach.  It may be just as successful as the VSAT
technology that was poised to sweep the data networking industry in the
mid-80s.

>and see why the developed it.

I'll look into it.

<snip>

>regarded by security people.

Kerberos is not used for applications requiring non-repudiation, whereas a
primary motivator for PKI use is NR..

>resource loss, revocation, backup and recovery.

I believe that all of the other issues you cite here are addressable via
means that do not require creating a proxy private key agent.

Stve