Subject: Re: Single Identity. Was: PKI International Consortium

From: [email-masked]
Date: Fri, 9 Apr 2004 20:03:06 -0600

note that the financial examples aren't really identification ... they
really are authentication ... and that actually helps make it work. it is
somewhat a fabrication to call it identification.

if i my financial authentication device is lost/stolen/breaks/fails/etc, i
can call up and AUTHENICATE myself as the owner of the account and get a
new one. The various questions are all effectively some form of
shared-secret ... that they hope the person on the street can remember.
They ask things like transactions on previous statements ... but they also
ask address, social security number, and mothers-maiden-name.  For
mothers-maiden-name ... they've never actually ID you ... they've
effectively asked for a shared-secret that they hope you can
remember/answer. Because of some issue about mothers-maiden-name might not
be the best of secrets ... I know people that make up values to fill in
that field .... you just have to make sure you remember that when the
mothers-maiden-name tag shows up ... you remember what secret you actually
filled in. The use of SSN is something of a schizophrenic problem ... it is
dual-use both as a (mandatory) identification (by gov. requirements) and as
a shared-secret (something you can answer for authentication).  The problem
with the mandatory identification aspect of SSN is that it becomes
propogated to a large number of places, compromizing is use as a
shared-secret authentication mechanism.

the authentication taxonomy is

* something you have
* something you know
* someting you are

shared-secrets are part of "something you know". hardware tokens are
example of "something you have". Digital signatures for authentication
purposes tend to be of the "something you have" nature ... i.e. in theory
you and only you have a copy of your private key. Note in this context ...
whether or not certificates are part of the paradigm is orthogonal to the
authentication paradigm.

Financial cards have also been of the "something you have" paradigm. In the
past, there has been great deal of effort in making it hard to counterfeit
these cards .... majority of it based on assuming that the criminal
generates the counterfeit cards completely from scratch. The current
problem is one of skimming where all the information to make a duplicate
card is copied (as opposed to having to start from scratch creating a
counterfeit card).

"something you have" authentication paradigm breaks down when the object is
no longer unique. this can happen with private keys if wherever it is
stored becomes compromized. It has also happened in the case of the EMV
counterfeit "yes cards" .... i.e. effectively the same technology for
skimming to make duplicate (counterfeit) magstripe cards is also used to
make duplicate (counterfeit) EMV cards.

the issue regarding the contents or nature of a certificate is totally
orthogonal to the use of publib/private key system as a "something you
have" authentication mechanism. The advantages that the mechanism has over
existing shared-secret paradigms ... 1) resilent to insider attacks that
copy the master secret database (there is no shared secret that they can
get that allows them to impersonate you), 2) phishing attacks are slightly
more complicated since you don't actually "remember" your private key.

The downside of private keys in a file on your PC ... is that it is
relatively suseptable to phishing and virus attacks ... if they can get you
to click on something and give up your logon password ... they can get you
to click on something and give up the (private key) file encryption key
(transmitting the file at the same time).

Placing the private key in a hardware token where effectively nobody can
get it .... then requires change in tactics. They have to convince you to
mail off the hardware token along with any PIN ... or get you to use the
hardware token in transactions on their behalf.

Again ... nothing in the uses of private key and/or hardware tokens for
authentication is directly related to certificates.  The certificates
paradigm is part of a structure for validating the results of the
authentication .... but is not part of the generation of the authentication
or the authentication taxonomy.

shaheen nasirudheen wrote:

Hello everyone.

Though new to this group, within a short span I understand there are people
who favor single identity and who does not. I also understand that there is
an effort towards standardizing or centralizing PKI among the Financial
Institutions. One such effort is Identrus. Thanks to some of the members of
this group who helped me with good information. However, moving forward,
can I look forward for a single identity that I can use to identify myself
to any public system that require identification and authentication? If
there is an ongoing effort in this regard, please let me know so that I can
participate.

Regards,

Shaheen Nasirudheen

--
Internet trivia, 20th anv: http://www.garlic.com/~lynn/rfcietff.htm