Subject: Identification = Payment Transaction?

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 12 Nov 2002 16:20:07 +0100

Survey regarding the future of  PKI trust networks
------------------------------------------------------

Traditionally certificates have been purchased (or just issued) for
an entity by a party that is concerned that the entity can be properly
identified in authentication- and signature-operations.

For a relying party (RP) to check certificate-status has mostly been a
public and free service.

The financial industry however, have in several recent PKI-ventures
shown that they intend to change this by treating lookup-services as
equivalent to payment transactions, where the RP's bank is used as a
"trust clearing center" communicating with the subscriber's bank that
must be a member of the same "trust network".  To make it technically
impossible for RPs to fully verify signatures without going through
the trust network (and paying for the services), root-certificates are
usually not "published".

I would be very happy to hear what the PKI community in general
think about this scheme as the future for PKI.  Off-list responses
will be treated as CONFIDENTIAL information.

Anders Rundgren

---

From: Stephen Kent <[email-masked]>
Date: Tue, 12 Nov 2002 11:44:45 -0500

>Survey regarding the future of  PKI trust networks

This is nothing new. The ACES program developed by the U.S. General 
Services Administration adopted an analogous model, in which U.S. 
residents get "free" certs for identifying them in online 
transactions with U.S. Government agencies. The TTPs that issue the 
certs then get paid for cert revocation status checking every time an 
agency wants to be an RP with regard to the cert.

This just shows that TTP CAs have lots of ways to extract money from 
people for certs, both up front and on an ongoing basis. It might 
motivate more companies to realize that they can issue their own 
certs to their employees and customers and not have to pay TTP CAs 
for such services.

Steve

---

From: "Marc Poulaud" <[email-masked]>
Date: Wed, 13 Nov 2002 09:02:47 -0000

Anders,

I used to work one of these ventures (as you know), and consult in this
space.

For me, the point is - are the banks/scheme providing a useful service
that businesses are willing to pay for? I think the answer is, in some
cases 'yes'.

I think the issues are around outsourcing and buying a trust service - do
corporates want to create their own capability (or parts of it) and manage
or do they want to off-load this and focus on core business? If you want a
service, are you willing to pay for the wider rule-sets wrapped around
these schemes which put a contractual and legal framework around it? If
so, then what cost model is fair and equitable?

In one scheme I sorta 'know', the cost model does not directly translate
into a price model for businesses - this is up to the banks to decide and
so may charge on a per cert validation or package it up some other way.
(as an aside, this is where the banks struggle - deciding how to
productise trust and then market it, but that's a different story).

Equally, I can see different businesses/models, where so a scheme does not
make sense - so it's horses for courses and so will co-exist with
'free-validation' models IMO.

Marc.
-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Anders Rundgren
Sent: 12 November 2002 15:20
To: [email-masked]
Subject: Identification = Payment Transaction?

Anders Rundgren