Subject: Re: Single Identity. Was: PKI International Consortium

From: [email-masked]
Date: Fri, 9 Apr 2004 17:30:36 -0400

Hello everyone.

Though new to this group, within a short span I understand there are people
who favor single identity and who does not. I also understand that there is
an effort towards standardizing or centralizing PKI among the Financial
Institutions. One such effort is Identrus. Thanks to some of the members of
this group who helped me with good information. However, moving forward,
can I look forward for a single identity that I can use to identify myself
to any public system that require identification and authentication? If
there is an ongoing effort in this regard, please let me know so that I can
participate.

Regards,

Shaheen Nasirudheen

-----------------------------------
This message may contain legally privileged and/or confidential
information. If you are not the intended recipient(s), or the employee or
agent responsible for delivery of this message to the intended
recipient(s), you are hereby notified that any dissemination, distribution
or copying of this message is strictly prohibited.  If you have received
this message in error, please immediately notify the sender and delete this
e-mail message from your computer.

                    "Anders Rundgren"                                                                                  
                    <anders.rundgren@t       To:     "Al Arsenault" <[email-masked]>, "PKIX list"                    
                    elia.com>                 <[email-masked]>, Shaheen Nasirudheen/JPMCHASE@JPMCHASE               
                    Sent by:                 cc:     "Stephen Kent" <[email-masked]>, "Arshad Noor"                      
                    owner-ietf-pkix@ma        <[email-masked]>, <[email-masked]>, "Terwilliger, Ann"       
                    il.imc.org                <[email-masked]>, "Eric Norman" <[email-masked]>               
                                             Subject:     Re: Single Identity. Was: PKI International Consortium       
                                                                                                                       
                    04/05/2004 09:01                                                                                   
                    AM                                                                                                 

AWA:  Speaking from practical experience (having a physical wallet lifted
in Prague a few years back), it was easier NOT having a single credential.
Okay, the wallet with the cash, credit cards, US driver's license, pictures
of the kids, medical insurance card, etc. is gone.  But, NOT the passport,
and not the emergency credit card kept separate from the rest for exactly
this eventuality.  Survival was assured until recovery could be
accomplished.

AR: In my opinion you are describing something like a "credential backup"
scheme which is pretty unrelated to the single credential issue.  Valid
questions arise, like: Where do you keep the backups? Where would you keep
your electronic IDs when on the road (where you need them)?  It looks to me
that the "always connected" world creates new problems requiring more
robust and universal solutions.   The globally supported trust network is
my shot as this problem.

AWA:  Now, map this to the virtual world, where everything is stored in
your mobile phone.  Whoops - mobile phone is lost/stolen.  So I go to the
nearest branch of the "issuing agency".  The conversation goes something
like Me: "excuse me, my name is Al Arsenault, and my ID was stolen.  I need
a new one".   Agency:  "Prove that's who you are".  Me:  "How?  My one
single ID was stolen, I need a new one".  Agency: "Yes, but if we believed
you based on just what you're telling us, it could deny service to the REAL
Al Arsenault, who our records show is out blithely spending money right
now". (Somebody call John Cleese - there's a great Monty Python skit in
here somewhere.)

AR: This situation is indeed a tricky one.  However, it gets more
manageable when issuers have 24/7 helpdesks which allows the agency to
look-up records and ask you to answer a few questions that only the
original issuer and you have the answers to.  Since agencies have to
authenticate to access external records (or identify themselves to an
issuer helpdesk), a screw-up may lead to the agency's loss of their
license.

AWA:  Yes, there's likely a way to PROVE that I'm the real Al Arsenault,
but I hope it doesn't involve biometrics - don't get me started down that
road. :-(

AR: Biometrics is of indeed a very vital part of such verifications.  Today
this may just be your picture but tomorrow it will be DNA.  Since identity
theft is admittedly the weak spot of the described scheme there are really
no alternatives to biometrics except abandoning the whole thing.  AFAIK the
US immigration authorities require (or are about to require) an extensive
set of biometrics in passports so either we foreigners have to stay at home
or deal with it.

AR: Regarding the value of single identities it is also a matter of cost.
The majority of people work for small businesses and these may find that
using the already existing bank-issued IDs will be easier to use than
putting out user-IDs and passwords.  The identity does not have to be an
SSN, it may be your bank client number or some completely artificial
number.  That is, bank-IDs do not have to "emulate" passports to be useful.

AR: Regarding multiple banks, I agree with you, you should not (mostly for
commercial and political reasons) force a network of TTPs to be direct TTPs
for each other.  So here there will be a deviation from the single ID.
However, you typically only need one "primary ID" for all your TTP-based
ID-relations.

best
AR = Anders Rundgren

---

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 11 Apr 2004 11:48:41 +0200

Shaheen,
May I as a long-term PKIX-list subscriber share some experiences
of what can be successfully discussed/RFCed etc and what does
not seem to work too well?

If we talk about FIs in an international consortium we are probably
into commercial activities. If we assume (this is not a truth, just
an assumption) that existing RFCs are suitable, the IETF does not
form a good foundation for discussing commercial, deployment,
or policy issues.   If you compare such an activity with payment-
networks like VISA, such discussions have been a fairly private
issues for the VISA members.

However, if the goal is a global TTP trust network, I don't
believe that the VISA approach works, as identity is much more
complex (as well as potentially considerably more far-reaching)
than transferring money in a closed payment network.

I would personally like to participate in a development of the
kind you are mentioning, although I believe that the "in scope"
issues are extremely hard as well as politically sensitive.

Here is an non-exhaustive list of issues that have to be dealt with:
1. Who is the relying party?
  Some possible answers: FIs only. FIs + e-govs.  "All", All but FIs(!).
2. Without having a standard card/container, is this really feasible?
3. Business model?
  Some possible answers: Four corner model. 
  Subscriber-based cost model. 
  Mixed model?
4. How to express FI identities?
  Some possible answers: Credit-card-like ID (ffffnnnnnnnnnnnn). 
  National IDs.
  Other.
  multiple credentials (national + CC-like)

Although very interesting and potentially very lucrative, my 
experiences so far with the financial industry, is that they don't
want to work "in open" which IMO is a prerequisite for a
global high-value TTP looking for a billions of customers.
Nothing below that level is going to work as the "brand"
will not be able to survive otherwise.

best regards
Anders

----- Original Message -----
From: <[email-masked]>
To: "Anders Rundgren" <[email-masked]>; "Al Arsenault" <[email-masked]>; <[email-masked]>; "Arshad Noor"
<[email-masked]>; "Terwilliger, Ann" <[email-masked]>; "Eric Norman" <[email-masked]>; "PKIX list"
<[email-masked]>; "Stephen Kent" <[email-masked]>; <[email-masked]>
Sent: Friday, April 09, 2004 23:30
Subject: Re: Single Identity. Was: PKI International Consortium

Hello everyone.

Regards,

Shaheen Nasirudheen

                    "Anders Rundgren"

                    04/05/2004 09:01
                    AM

best
AR = Anders Rundgren