Subject: Re: A $25,000,000,000 PKI Was:Spec. on QC-low-fat & QC-heavy-bio

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 7 Apr 1999 00:45:43 +0100

Steve,

>>Of course, they are built on the fundamental principle that the
>>client always has the "final" cert and key.  CyberPhone is not.
>
>Yes, this is the assumption, and it is a widely held one.  To change it a
>lot of folks will need to be convinced otherwise.  You have a lot of work
>ahead :-)!

I know.  But its fun as well.

<snip>

>> Did you actually read the dynamic certs paper?

>Yes, and I don't buy all of it's premises.  The companies are the ones on
>the hook, as you say, but they also need individual accountability, hence
>the need for individual certs.

You got that in the CyberID.  Accountability is internal affaires is'nt it?

> Nobody has a lot of experience with large
>scale deployment of PKIs in these contexts, so a statement about the
>relative difficulties of deployment of certs to end users vs. the approach
>you propose is premature. Insecure servers are a growing problem for
>businesses, so I also challange your second assertion.

SET is an example of a large-scale PKI deployment that has _almost_
flopped due to some of the factors that CyberPhone solves. Like:

Certificate distribution
Thin client sw
Mobile universal usage

<large snip>
>Finally, your proposal is clearly focused on one particular deployment
>model, which may or may not be realized.  There are others, based on more
>computationally capable, mobile, personal devices, e.g., PDAs.

Computationally capable devices do not solve
client certificate or client software distribution.

The market for mobile phones is so much bigger than for other
devices (PDAs, PCs) etc. so IF this solution gets wide acceptance on
the mobile phone market - most other client PKI solutions MAY just die.
I.e. why pay additional money for certs, readers, software if your
employees already have a high-quality solution in their hands?

BTW, why do you think MSFT is so interested in the mobile phone market?
Because it is there the future of IT is happening!

> As I said
>before, you should pursue any implementation approach you think is
>fruitful, but don't ask this standards body to tailor parts of its work to
>facilitate your (decidely nont mainstream) approach to using certs.

It COULD  become mainstream...

Now we both know pretty well where we stand in this case so
could please somebody else comment on this? 

Anders

---

From: Stephen Kent <[email-masked]>
Date: Wed, 7 Apr 1999 20:28:18 -0400

Anders,

>flopped due to some of the factors that CyberPhone solves. Like:

I know a numnber of reasons why SET has not been accepted in the U.S., if
that's the context you're citing, and they are largely independent of the
issues you cite.  For example, U.S. consumer protection laws make the
advantages of SET over simple use of SSL and a credit card number
unattractive to users.  Since most online merchants can make a fair amount
of money despite the security limitations (e.g., lack of origin
non-repudaition) of the current paradigm, there is insufficient motivation
for them to change to SET.  Since most of the purchases over the web are
done from PCs, the thin n client argument is not relevant.

>client certificate or client software distribution.

Most of the client cert distribution problems I've had client discuss are
not solved by your proposal, merely through centralization of certificate
storage and by having a server act as a proxy for applying signatures.

>employees already have a high-quality solution in their hands?

All of our employees have computers, those who travel have laptops.  Not
all have cell phones.  of the ones that do have cell phones, few would be
capable opf making use of the certs you describe, i.e., not many are PCS
phones.

The solution you propose is definately NOT high quality. It is an effort to
take advantage of devices with limited capabilities, and skew security
design principles to accommodate these limitations.  Such an approach might
be commercially successful; as others have pointed out, convenience and
good marketing often win out over other factors.  But that doesn't mean we
have to
skew our standards to embrace such approaches.

>Because it is there the future of IT is happening!

Microsoft is interested in almost everything; after missing the Internet's
initial surge they hedge their bets extensively, a luxury that comes from
having so much money to play with.

>could please somebody else comment on this?

I'm sure they will.

Steve

---

From: Paul Krumviede <[email-masked]>
Date: Wed, 07 Apr 1999 21:24:26 -0700

> >could please somebody else comment on this?

One somebody else's comment:

I'm uncomfortable with the suggested use of certs.

-paul