Subject: Re: PKI International Consortium

From: [email-masked]
Date: Fri, 2 Apr 2004 17:37:04 -0500

Hello everyone,

Quote from bbn.com : "In 1968, the Advanced Research Projects Agency (ARPA)
sent out a Request for Quotation (RFQ) to build a network of four Interface
Message Processors (IMPs). Many of the large computer and
telecommunications organizations didn't even respond--they thought it was
impossible. " - http://bbn.com/arpanet/index.html.

If the pioneers believed that "Internet" is impossible, then I dont think
we would enjoy sending these emails today.

Anyway, consider the following:

1. A central authority issues and maintains certificates for the customers
of FI. The central authority prescribes a set of standards and regulations
on creation, issuance and maintenance of the certificate.
2. The FI or independent agents may issue the certificate on behalf of the
central authority. However, the certificate issued to the customer should
not have any direct relation to the FI (Financial Institution).
3. The customer may subscribe for the services of an FI, identifying
himself producing the certificate issued by the central authority.
4. All verification of the certificate should be verified referring to the
central authority.
5. The customer has to produce the certificate to the FI whenever he/she
would like to do a transaction. The FI may check for subscription of the
customer and verify the credentials referring to the central authority.

Of course, the availability, integrity and confidentiality of the system
has to be considered for an ideal process such as above. However, with
right technology and prevention mechanism in place, I believe such a system
may be possible. Think about an "International Passport" with which you can
travel to any country. However, your passport require an entry visa
(subscription)  to the destination country. This way I avoid travelling
with multiple passport (for person with multiple citizenship).

Regards,

Shaheen Nasirudheen
JPMorgan ACCESS, Portal Security

-----------------------------------
This message may contain legally privileged and/or confidential
information. If you are not the intended recipient(s), or the employee or
agent responsible for delivery of this message to the intended
recipient(s), you are hereby notified that any dissemination, distribution
or copying of this message is strictly prohibited.  If you have received
this message in error, please immediately notify the sender and delete this
e-mail message from your computer.

                    Arshad Noor                                                                                        
                    <arshad.noor@stron       To:     Stephen Kent <[email-masked]>                                       
                    gauth.com>               cc:     Shaheen Nasirudheen/JPMCHASE@JPMCHASE, PKIX list                  
                                              <[email-masked]>                                                      
                    04/02/2004 04:39         Subject:     Re: PKI International Consortium                             
                    PM                                                                                                 

I would concur with you, Steve, that a single certificate that serves all
purposes, is neither practical nor desirable.  (Although I must confess
to occassionally dreaming of such a utopian environment, sometimes).

However, I believe, it is reasonable - assuming appropriate policy,
process, implementation and most importantly, cooperation - to have
industry-specific identities that may serve us all better.  ("Identity
Firewalls" - http://www.strongauth.com/newsletters/2003Jan17.html).

Companies waste far too much time and money today, building
duplicate identity infrastructures - and consequently tying their own
hands with context-sensitive identities - because it appears to be the
path of least resistance to them.  But as the cost of identity theft &
of managing those numerous identity infrastructures surpasses the
perceived savings from using this path of least resistance, companies
will be forced to rethink that strategy.

Arshad Noor
StrongAuth, Inc.

----- Original Message -----
From: Stephen Kent <[email-masked]>
Date: Friday, April 2, 2004 8:47 am
Subject: Re: PKI International Consortium

>
> At 10:57 AM -0500 4/2/04, [email-masked] wrote:
> >Hello everyone,
> >
> >I appreciate your feedback and most of the replies were referring to
> >identrus.com . My basic concern is from a customer's point of
> view. If I
> >have a digital certificate issued by a single authority that is
> considered>trusted internationally by all financial as well as
> other commercial
> >institutions, then I do not require to have a certificate for
> Institution>-1 and another for Institution -2. Do we have
> something in place that takes
> >of this issue. I would be happy to carry and protect that one
> certificate>which is trusted by everyone.
> >
> >Thank you,
> >
> >Shaheen Nasirudheen
> >JPMorgan ACCESS, Portal Security
> >978 805 1815
> >
>
> The notion of the one cert that is good for everything is probably
> never going to be a reality, fortunately. Note there there are no
> physical credentials that have this property. Why would you
> believe
> that digital credentials could overcome the organizational
> obstacles
> that contribute to the existence of context-limited credentials?
> Moreover, consider the awful consequences associated with a
> compromise of the private key associated with such a cert, if it
> existed.
>
> Steve
>
>

---

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 4 Apr 2004 16:37:51 +0200

Dear PKIers,
I could not resist this one as I have worked with this idea since
1997....

The quest for a single identity
---------------------------------
Assume that an international consortium of banks indeed agreed
on a common certificate issuance policy of a relatively high level
(as well as shelving the four-corner model), I believe you would
have a very good foundation for a universal single-identity scheme.
It is worth noting that a single identity is a reality in Sweden since
around 1960 so this is a time-proven scheme as well.

A tricky real-life use-case
-----------------------------
Now assume that you one day lose your wallet [1] with ID-
certificates when you are on an oversea trip.  Who will have
the swift and secure way back?  The individual with a handful
of locally issued credentials, or the individual who have a
single credential issued by a member of a trusted network of
international issuers having branch offices in every town of
any size worth mentioning?

Most security folks only look to revocation issues but it is
really at least as critical to get replacement credentials as you 
in an anticipated "e-society" will be completely handicapped
without getting access to your work, bank, e-government etc.

TTPs rule - Like it or not
-----------------------------
Some people object to the TTP idea but the reality is that
all issuances not based on DNA or similar "body-based-
authentication", already fully depend on TTP-issued
passports, driver licenses, gas bills (!) etc.

So you really need multiple identities?
-------------------------------------------
The need for multiple identity when you interact with your own
trusted providers including your employers, banks, or emerging
e-government services seems hard to justify (unless for potential
cost issues with respect to the issuer).

When you OTOH interact with non-trusted providers or
providers where your identity as an individual is of secondary
importance or even is important to protect, SAML, 3D Secure,
etc. offer a great way of leveraging a single identity.  That is,
these schemes allow you to be a VISA card, B2B purchaser,
etc. without having to have such resources issued to you to
be carried around, as they exploit the on-line paradigm [2].

The only real problem
-------------------------
The only real problem stopping this vision is that banks are
slove movers, cooperate poorly, and do not participate in
the development of open standards, and may therefore miss
this golden opportunity.  It is really about acknowledging
that an identity business potentially targeting the entire
"e-society" is very different to running payment networks,
as only e-the former reach into the hart of relying parties'
IT-systems. 

Regards
Anders Rundgren
Consultant, e-infrastructure
+ 46 70 - 627 74 37

1] The "wallet" is likely to be our mobile phones as this
device is developing at record speed, is replaced every 18
months (ave.), and is already most people's favorite IT-toy.
The local wireless connectivity today shipping in about 25%
of all PCs is an excellent replacement for card readers.

2] A couple of papers showing how on-line changes everything:
http://www.x-obi.com/OBI400/pki4org.pdf
http://w1.181.telia.com/~u18116613/CAeXtraInfo.pdf

---------------------------------------------------------
---------------------------------------------------------

----- Original Message ----- 
From: <[email-masked]>
To: "PKIX list" <[email-masked]>
Cc: "Stephen Kent" <[email-masked]>; "Arshad Noor" <[email-masked]>; "Anders Rundgren" <[email-masked]>
Sent: Saturday, April 03, 2004 00:37
Subject: Re: PKI International Consortium

Hello everyone,

Regards,

Shaheen Nasirudheen

                                                                                                                       
                    Arshad Noor                                                                                        

Arshad Noor
StrongAuth, Inc.

---

From: "Al Arsenault" <[email-masked]>
Date: Sun, 4 Apr 2004 21:15:18 -0400

A few comments in-line, prefaced by my initials, "AWA".

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Anders Rundgren
> Sent: Sunday, April 04, 2004 10:38 AM
> To: PKIX list; [email-masked]
> Cc: Stephen Kent; Arshad Noor; [email-masked]; Terwilliger, Ann; Eric
> Norman
> Subject: Single Identity. Was: PKI International Consortium
> 
> 
> 
> Dear PKIers,

AWA:  This really seems to be a function of national culture.  In some places - Sweden and other countries among them - a "single identity" is accepted as part of life.  In other cultures, it's not only not accepted, but the entire idea is abhorrent.  This is actually a good thing, to me:  the world is different; let different people/cultures live by their own rules rather than trying to force them all into one thing.

> A tricky real-life use-case

AWA:  Speaking from practical experience (having a physical wallet lifted in Prague a few years back), it was easier NOT having a single credential.  Okay, the wallet with the cash, credit cards, US driver's license, pictures of the kids, medical insurance card, etc. is gone.  But, NOT the passport, and not the emergency credit card kept separate from the rest for exactly this eventuality.  Survival was assured until recovery could be accomplished.

AWA:  Now, map this to the virtual world, where everything is stored in your mobile phone.  Whoops - mobile phone is lost/stolen.  So I go to the nearest branch of the "issuing agency".  The conversation goes something like Me: "excuse me, my name is Al Arsenault, and my ID was stolen.  I need a new one".   Agency:  "Prove that's who you are".  Me:  "How?  My one single ID was stolen, I need a new one".  Agency: "Yes, but if we believed you based on just what you're telling us, it could deny service to the REAL Al Arsenault, who our records show is out blithely spending money right now". (Somebody call John Cleese - there's a great Monty Python skit in here somewhere.)

AWA:  Yes, there's likely a way to PROVE that I'm the real Al Arsenault, but I hope it doesn't involve biometrics - don't get me started down that road. :-(

> without getting access to your work, bank, e-government etc.

AWA:  Yes, absolutely.  

> TTPs rule - Like it or not

AWA:  I disagree.  These are generally Second-Party (not third) for their primary purposes. Examples:

	- Governments issue passports.  They're used to identify you to other Governments (and your own). Second party issuance.  Yes, it's true that passports are sometimes used in other circumstances, but that's not their primary reason for being.
	- Driver's licenses are issued, in the US, by state Motor Vehicle Agencies (the names vary, but the principle's the same).  They're meant to show that you are allowed to drive under some conditions (e.g., must wear glasses/contact lenses; under-age so cannot drive alone at night; can operate a motorcycle; can operate a commercial truck/bus; etc.)  Second party issuance.  Yes, these get used a lot for purposes other than showing that you can legally operate a motor vehicle just because it's so darned easy, but that's not the purpose for which they were created.
	- Gas bills are generated and managed by the utility company.  They don't want to know or care about my driver's license or whether I have a passport; they care about my address and payment history.  

Yes, it's true that in many cases, the second parties who issue these IDs outsource some of their IT infrastructure, so there are some "third parties" involved. But the bottom line is that the US Department of State doesn't go to VeriSign or anybody else to issue you a passport.  They do it by themselves or with the aid of selected Registration Agents like the US Postal Sservice.

> So you really need multiple identities?

AWA: The issue is part cultural, part cost.  

	My employer knows me as an employee.  I have an employee number,  which is NOT the same as my tax id, my social security number, my passport number, or any of my credit card or bank account numbers.  BBN uses to reference all of my employment records since I started working here.  That's it.  There's no reason for them to know or care about any other number (except the tax/social security stuff, since they have to get the taxes right.  But that's handled with a mapping.)
	Suppose I have relationships with several banks (not uncommon in the US).  Bank 1 knows me as its account_1.  Bank_2 knows me as its account_2.  There's no reason these have to be synchronized; why force the two banks to combine/merge/whatever their account records? It would be a cost, with no benefit. And, it's just not necessary.  There's no real reason why Bank 1 and Bank 2 need to know me by a common identifier.  If I want them to be able to do things for me, like electronically transfer funds from one to the other, I'll provide them with the mapping.  If I don't, I won't and they're happier not knowing about each other. 
	Now, of course, it's likely that many places with whom I interact financially do know me by a common identifier - the US Social Security Number.  (Not all of them know it, but the employers and banks certainly do.)  They COULD if they want combine around that as a common identifier, but culturally, at least in the US, that's seen as a really bad idea. It lets too much information about you be aggregated, and is considered to be a major privacy problem.  Other societies have similar views; e.g., the Hong Kong ID used by all legal residents of the HKSAR is considered to be private information and its unauthorized disclosure is generally a violation of laws.
	In societies where this cultural view is not held - e.g., in Sweden according to Anders - then it's quite likely that many of my arguments do not hold. Fine - different places are different.
	
> be carried around, as they exploit the on-line paradigm [2].

AWA:  No,  the real "problem" is that many cultures in the world think having a single identifier for all purposes is a really bad idea.  That's certainly what my opinion is.  I recognize that others disagree, but.. 

> Consultant, e-infrastructure

		Al Arsenault
		BBN Technologies

---

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 5 Apr 2004 15:01:13 +0200

AR: In my opinion you are describing something like a "credential backup" scheme which is pretty unrelated to the single credential issue.  Valid questions arise, like: Where do you keep the backups? Where would you keep your electronic IDs when on the road (where you need them)?  It looks to me that the "always connected" world creates new problems requiring more robust and universal solutions.   The globally supported trust network is my shot as this problem.

AR: This situation is indeed a tricky one.  However, it gets more manageable when issuers have 24/7 helpdesks which allows the agency to look-up records and ask you to answer a few questions that only the original issuer and you have the answers to.  Since agencies have to authenticate to access external records (or identify themselves to an issuer helpdesk), a screw-up may lead to the agency's loss of their license.

AR: Biometrics is of indeed a very vital part of such verifications.  Today this may just be your picture but tomorrow it will be DNA.  Since identity theft is admittedly the weak spot of the described scheme there are really no alternatives to biometrics except abandoning the whole thing.  AFAIK the US immigration authorities require (or are about to require) an extensive set of biometrics in passports so either we foreigners have to stay at home or deal with it.

AR: Regarding the value of single identities it is also a matter of cost.  The majority of people work for small businesses and these may find that using the already existing bank-issued IDs will be easier to use than putting out user-IDs and passwords.  The identity does not have to be an SSN, it may be your bank client number or some completely artificial number.  That is, bank-IDs do not have to "emulate" passports to be useful.

AR: Regarding multiple banks, I agree with you, you should not (mostly for commercial and political reasons) force a network of TTPs to be direct TTPs for each other.  So here there will be a deviation from the single ID.  However, you typically only need one "primary ID" for all your TTP-based ID-relations.

best
AR = Anders Rundgren

---

From: Stephen Kent <[email-masked]>
Date: Mon, 5 Apr 2004 11:15:43 -0400

>The quest for a single identity

As Al notes, different cultures have different operating models. What 
may work for Sweden may not work elsewhere.

>A tricky real-life use-case

As Al pointed out, reality is much different from your model. A real 
advantage to having multiple credentials for different purposes is 
that you can use the alternatives that were not lost/stolen. Also, in 
the U.S. some folks subscribe to a service that will notify affected 
credential issuers when you lose credentials, and that eases the 
burden if multiple credentials are lost at the same time.

>without getting access to your work, bank, e-government etc.

When I needed to have my wife's Amex card replaced a few years ago, 
not because we lost it but because of fraudulent use, we had a new 
one in less than 48 hours. That is not the sort of service I would 
expect from my government ;-) BTW, given your notion of a "trusted 
network of International issuers" I guess Amex would qualify, but I 
doubt that my Amex card will be accepted by immigration folks at 
either end of my return trip. I'll need to contact my embassy or 
consulate for that sort of assistance.

>TTPs rule - Like it or not

nonsense. an organization that is authoritative for the credentials 
it issues is NOT like the TTPs you cite, which are authoritative for 
nothing, but which are good at collecting fees.

I won't bother addressing the rest of your message; Al did a good job 
of noting the issues I would have commented upon.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Mon, 5 Apr 2004 11:12:32 -0400

>we would enjoy sending these emails today.

As the Chief Scientist for Information Security here at BBN, I don't 
think the analogy is at all relevant to our current discussion.

>with multiple passport (for person with multiple citizenship).

You miss the point, and your analogy is seriously flawed. Most folks 
have only one passport; unless you hold dual citizenship you 
generally don't get another passport. Visas are sometime required to 
admission to a country, in conjunction with a passport. In that 
sense, they are a lot like attribute certs used with identity certs.

A passport is the appropriate credential for identifying you as a 
citizen  of a specified country, but that's all it does. The name 
info on it is not unique, and the unique ID (the passport number) is 
not of use to most relying parties.  Try using your passport to make 
a purchase, instead of using a credit card and see how well this 
universal ID works. Conversely, try giving your credit card to the 
immigration officials and see what happens :-)

Steve