Subject: RE: The Bank-model Was: Employee Certificates - Security Issues

From: "Hamrick, Matt" <[email-masked]>
Date: Fri, 11 Oct 2002 21:40:34 -0400

Sadly I am still confused as to what it is that Anders is objecting to: PKI
in general, X.509 in particular, or the fact that WAY too many people ignore
the semantics of what it means to hold a certificate.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Friday, October 11, 2002 5:18 PM
To: Anders Rundgren
Cc: Hamrick, Matt; [email-masked]
Subject: Re: The Bank-model Was: Employee Certificates - Security Issues

semi-related posting in spki mailing list
http://www.garlic.com/~lynn/aadsm12.htm#33 two questions about spki

---

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 13 Oct 2002 17:22:59 +0200

Matt,
There is a short explanation and that is that a trivial thing like
a purchase order involves at least three parties (purchaser,
purchaser organization and supplier) while PKI only supports
two parties (end-entity and relying party).

The Enterprise model does not take this in account which is
the reason why few if any business system vendors support
the Enterprise model.

The Bank model addresses this by using multiple more
or less independent PKIs.  The Bank model needs as a
minimum one X.509 certificate and key per organization.
Due to the Bank model's "non-personal" way of working,
it is seldom relying on X.500/LDAP-support except for
internal use.  UDDI registries are probably more
conformant with future needs of the Bank model.
The Bank model minimizes the need for publishing (or
leaking) information concerning employees, as a key element
of banking is, and has always been, client integrity.

The Enterprise model is based on the defunct X.500 vision
where we all would be a part of a giant PKI and published
in a globally accessible directory.  This is would be OK
if "e-business" were equivalent to sending signed and
optionally encrypted e-mail, using Outlook etc.
But, AFAIK, this is miles away from where the
e-business industry in general is headed.

cheers,
Anders