Subject: Re: PKI International Consortium

From: [email-masked]
Date: Fri, 2 Apr 2004 10:57:19 -0500

Hello everyone,

I appreciate your feedback and most of the replies were referring to
identrus.com . My basic concern is from a customer's point of view. If I
have a digital certificate issued by a single authority that is considered
trusted internationally by all financial as well as other commercial
institutions, then I do not require to have a certificate for Institution
-1 and another for Institution -2. Do we have something in place that takes
of this issue. I would be happy to carry and protect that one certificate
which is trusted by everyone.

Thank you,

Shaheen Nasirudheen
JPMorgan ACCESS, Portal Security
978 805 1815

-----------------------------------
This message may contain legally privileged and/or confidential
information. If you are not the intended recipient(s), or the employee or
agent responsible for delivery of this message to the intended
recipient(s), you are hereby notified that any dissemination, distribution
or copying of this message is strictly prohibited.  If you have received
this message in error, please immediately notify the sender and delete this
e-mail message from your computer.

                    "Anders Rundgren"                                                                                 
                    <anders.rundgren@       To:     "PKIX list" <[email-masked]>, Shaheen                          
                    telia.com>               Nasirudheen/JPMCHASE@JPMCHASE                                            
                                            cc:                                                                       
                    04/02/2004 11:28        Subject:     Re: PKI International Consortium                             
                    AM                                                                                                

Hi Shaheen,
There are several PKIs run by FIs, even on an international level.
However, I have some difficulties with the phrase
"certificates for the members"?

Is a "member" an FI organization, FI employee or an FI customer?

For the premier category I believe VISA does that for the 3D Secure
network.   For FI employees I don't know if there really is any
big need for such as these certificates have little use except internally.
Well, Identrus have indeed sold such services to a few banks.

Regarding the third category, it is interesting to note that banks
seem to take the lead in issuing "citizen-certificates" as a
citizen=bank customer.  These FA CAs are though not really
international due to some basic problems like the lack of
standards for expressing citizen identities in various regimes.
Here the customer is really e-governments although the certificates
can often be used for on-line banking as well.

www.identrus.com
www.bankid.com
www.bankid.no

Anders

----- Original Message -----

From: <[email-masked]>
To: "PKIX list" <[email-masked]>
Sent: Thursday, April 01, 2004 16:30
Subject: PKI International Consortium

Hello,

I would like to know if there is any international consortium of financial
institutions that maintain a PKI and issues certificates for the members.
If so, what are the standards followed? Any information would be helpful.

Regards.

Shaheen Nasirudheen
JPMorgan ACCESS, Portal Security

-----------------------------------
This message may contain legally privileged and/or confidential
information. If you are not the intended recipient(s), or the employee or
agent responsible for delivery of this message to the intended
recipient(s), you are hereby notified that any dissemination, distribution
or copying of this message is strictly prohibited.  If you have received
this message in error, please immediately notify the sender and delete this
e-mail message from your computer.

---

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 2 Apr 2004 19:13:00 +0200

Shaheen,
I believe this is a *very* good idea which I have touted myself.

The problem I see, is that FIs do not accept the open PKI
approach which makes their offers less tasteful.

That is, FIs (unlike practically all other CAs) force each
relying party to:
- Have a contract with each FI trust network
- Install the trust network's proprietary (often licensed) verification software
- Get and install a unique ID from the relying party's FI

http://w1.181.telia.com/~u18116613/e-government-ID-A.Rundgren.pdf

Due to this, I believe we will not get this wonderful PKI that
you and I dream of but rather stay with an ocean of highly
variant and incompatible "security solutions".

Anders

----- Original Message ----- 
From: <[email-masked]>
To: "PKIX list" <[email-masked]>
Cc: "Anders Rundgren" <[email-masked]>
Sent: Friday, April 02, 2004 17:57
Subject: Re: PKI International Consortium

Hello everyone,

Thank you,

Shaheen Nasirudheen

---

From: Stephen Kent <[email-masked]>
Date: Fri, 2 Apr 2004 11:47:32 -0500

>JPMorgan ACCESS, Portal Security

The notion of the one cert that is good for everything is probably 
never going to be a reality, fortunately. Note there there are no 
physical credentials that have this property. Why would you believe 
that digital credentials could overcome the organizational obstacles 
that contribute to the existence of context-limited credentials? 
Moreover, consider the awful consequences associated with a 
compromise of the private key associated with such a cert, if it 
existed.

Steve