Subject: Re: PKI International Consortium

From: [email-masked]
Date: Fri, 2 Apr 2004 16:46:04 -0700

it isn't necessarily just authentication that a relying party may have to
worry about with regard to the operation that they might be trusting the
certificate for .... but also things like authorization. the concept of a
certificate is that the relying party can trust the certificate in an
offline environment w/o necessarily any recourse to any additional
information.

the issue of recourse to additional information may because of things like

1) privacy .... the early x.509 "identity" certificates were found to
represent signficiant privacy compromise, especially when broadcasting all
of the place. as a result, there was retrencement to relying-party-only
certificates .... where it was sufficient to authenticate the entity as
being authorized to perform some set of operations against some account
record.

2) value ... the transaction is of sufficient value and/or complexity that
it is worthwhile to perform a online transaction (as opposed to an offline
operation purely relying on the contents of a certificate).

Note, however, that majority of relying-party-only certificates were used
in operations involving some value and therefor justified an online
operation with access to timely and/or aggregated information (aka
sufficient funds to actually cover a financial transaction).

3) authorization ... the issue may not have anything at all to do with your
identity, but whether or not you can be authenticated (not identified) as
being an authorized employee or an authorized individual to perform
transactions against a specific bank account. Just because I can proov I'm
John Smith ... isn't sufficient to establish that I'm an authorized
employee of any specific corporation and therefor entitled to enter an
employee only area.

It isn't context-sensitive identity infrastructure ... they require
context-sensitive authorization (although sometimes there is significant
confusion and institutions build identity infrastructures that are totally
orthogonal to their need for authenticationa nnd authorization
infrastructures).

In many of these situations, then stale, static certificates can be totally
redundant and superfluous ... either because they are providing information
that has no direct bearing on the operation being performed by the relying
party and/or because the relying party will be doing an online operation
with the authoritative agency providing real-time and/or aggregated
information (not possible with a stale, static, offline certificate).

[email-masked] on 4/2/2004 2:39 pm wrote:

I would concur with you, Steve, that a single certificate that serves all
purposes, is neither practical nor desirable.  (Although I must confess
to occassionally dreaming of such a utopian environment, sometimes).

However, I believe, it is reasonable - assuming appropriate policy,
process, implementation and most importantly, cooperation - to have
industry-specific identities that may serve us all better.  ("Identity
Firewalls" - http://www.strongauth.com/newsletters/2003Jan17.html).

Companies waste far too much time and money today, building
duplicate identity infrastructures - and consequently tying their own
hands with context-sensitive identities - because it appears to be the
path of least resistance to them.  But as the cost of identity theft &
of managing those numerous identity infrastructures surpasses the
perceived savings from using this path of least resistance, companies
will be forced to rethink that strategy.

Arshad Noor
StrongAuth, Inc.

---

From: Arshad Noor <[email-masked]>
Date: Fri, 02 Apr 2004 19:49:49 -0800

I am in complete agreement with you, Lynn.  An industry-specifc
identity should be designed to perform only a single function -
authenticate the holder of the credential.  Authorization must
ALWAYS be determined by the context that has successfully
authenticated the entity - and those authorization rules must
always be owned and controlled by the context owner.

There are some assumptions I make wrt industry-specific identities
(not exhaustive):

a) They are used only in an online context; while certificates
    can be used perfectly well offline too, the RP has greater
    assurances when used only within online contexts.  Given the
    nature of the always-online Internet and the services that are
    being built on top of it, this is not an unreasanable assumption
    anymore;

b) The single credential for the individual will suffice regardless
    of the value of the transaction; this implies that the level of
    assurance that needs to be built into that credential is high,
    thereby increasing the initial cost of issuance.  However, since
    that cost is spread out across an entire industry (hopefully, for
    a very long duration) the actual cost borne by the industry per
    credential will be lower than for any individual company within
    that industry. The advantage for any given company to sign up to
    this model?  All companies within that industry have the same level
    of assurance in the credential for any level transaction.  (There
    are other advantages too).

c) Since the credential is industry-specific, each industry will come
    up with its own identifier per entity (besides the unique certificate
    DN in the credential) that will be completely unrelated to other
    identifiers in other industries.  This, coupled with more secure
    practices in systems management, data-management & software
    development will eliminate the privacy issues.  It will make no
    difference whether you know my Social Security Number, birthdate
    or my mother's maiden name, because modified business practices
    (based on these new credentials) will eliminate the value of this
    data to identity thieves.  Will other data become just as valuable
    to the thieves?  Almost certainly, but they're also going to have
    to steal the physical device that stores my industry-credential
    along with the PIN that I carry in my head to unlock the device.
    The risk is never eliminated, but the probability of damage is
    reduced.

I do not deny that there are lots of other issues that need to be
addressed (I'm in the middle of writing a much more comprehensive
treatise to discuss these), however, given the losses borne by
consumers (ultimately) - $53B in 2003 according to the FTC
http://www.ftc.gov/opa/2003/09/idtheft.htm, I believe the issue
has become costly enough to consider a radical overhaul of America's
identity infrastructure.

Arshad Noor
StrongAuth, Inc.