Subject: IBM alternative to PKI?

From: "Dean Adams" <[email-masked]>
Date: Mon, 13 May 2002 12:36:22 +0100

Hi,
    Does anynone know-of and have comment on this?

UK plans smarter ID card

The Office of the e-Envoy is looking at alternatives to PKI (public key
infrastructure) technology for making secure electronic transactions.
Officials have held talks with supplier IBM to devise a new form of
electronic ID card intended to avoid the commercial and privacy problems
associated with PKI technology.

The technology, known as the "empowerment model", could be used both in the
private and public sectors to authenticate users of electronic services, a
top IBM executive told Government Computing News.

----------------------------------------------------------------------------
----
      Dean Adams Mobile: +44 (0) 7989 385914
      Trustis Limited Direct Tel/Fax: +44 (0) 1252 734320
      49 Whitehall Office Tel: +44 (0) 20 7451 1490
      London SW1A 2BX Office Fax: +44 (0) 20 7484 7961
      email: [email-masked] Web: http://www.trustis.com

The information in this message is confidential. It is intended solely for
the addressee. Access to this message by anyone else is unauthorised. If you
are not the intended recipient, any disclosure, copying, distribution or any
action taken or omitted to be taken in reliance on it, is prohibited and may
be unlawful.

Any attachments to this message have been checked for viruses, but please
rely on your own virus checker and procedures.

If you contact us by e-mail, we may store your name and address to
facilitate communications.

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 14 May 2002 10:00:23 +0200

Dean,
I do not know anything of e-Envoy but I do know a few things concerning PKI and smart cards.  There are indeed commercial problems associated with smart cards.  But does it get better by introducing yet another type of card and credentials?
 
A major problem is that the card vendors have pushed "branding" and other standards-defying things leading to high costs and low interoperability.  Due to this, Windows does AFAIK not support a single PKI-card without adding external proprietary SW.  The same goes for all other OSes (although the other OSes are usually lagging even the proprietary SW). 
 
The privacy (or rather "the wrong information to the wrong party") problem, nowadays have solutions like OASIS' SAML, and VISA's 3D Secure that extends client-PKI by delegation which indeed is "empowerment" in a completey distributed on-line fashion.   Such schemes also eliminate the need for complex multi-function cards, which is yet another thing that has hampered deployment.
 
A blocker for potential card-buyers is that it is no longer a secret that mobile phones are likely to replace the card itself, the only real uncertainity is when and how.  When could be relatively soon if the phone-makers unite and make the PKI solution independent of the subscription solution (i.e. not mixing PKI with the SIM-card in the case of GSM).
 
cheers,
Anders Rundgren
  ----- Original Message ----- 
  From: Dean Adams 
  To: [email-masked] 
  Sent: Monday, May 13, 2002 13:36
  Subject: IBM alternative to PKI?

  Hi,

  UK plans smarter ID card 

  The Office of the e-Envoy is looking at alternatives to PKI (public key infrastructure) technology for making secure electronic transactions. Officials have held talks with supplier IBM to devise a new form of electronic ID card intended to avoid the commercial and privacy problems associated with PKI technology. 

  The technology, known as the "empowerment model", could be used both in the private and public sectors to authenticate users of electronic services, a top IBM executive told Government Computing News. 

------------------------------------------------------------------------------

  The information in this message is confidential. It is intended solely for the addressee. Access to this message by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful.

  Any attachments to this message have been checked for viruses, but please rely on your own virus checker and procedures.

  If you contact us by e-mail, we may store your name and address to facilitate communications.