Subject: Two invitations to "WebSigning" standardization efforts

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 27 Feb 2006 22:02:26 +0100

Dear Web Signature-lovers,

Apparently there is some light in this tunnel since at least five competing efforts have been raised more or less simultaneously.  Somewhat oddly, they all have a European heritage.

Anders Rundgren

Invitation #1:
http://middleware.internet2.edu/pki06/
http://middleware.internet2.edu/pki06/agenda.pdf  Wednesday there will be a short WASP (Web Activated Signature Protocol) presentation by yours truly.
WASP is designed to be the Internet browsers' counterpart to the S/MIME signature support in e-mail clients.

Invitation #2:
---- Original Message ----- 
From: Bud P. Bruegger 
To: bud P. Bruegger ; Baudouin de Sonis 
Sent: Monday, February 27, 2006 09:14
Subject: Invitation to eForum eID WG meeting, March 8, Brussels

Dear Members of the eID Community,

We would like to invite you to participate in a workshop that the eForum organizes for March 8 in Brussels.  We have put together an intensive work session to launch an international collaboration on two topics:

* An URL Programming Interface (UPI) for web access to smart card services 
* Server-Side Privacy-Enhancement.

The former topic is important in order to create a central point of control for the access of smart card services, such as digital signature, over the web.  The approach has originally been proposed by Sun Microsystems and is integral part of the Austrian Citizen Card Concept  (in the Security Layer).  It promises to bring increased security and a much increased user experience (consistent look and feel across web applications) as compared to the excessive diversity of current solutions.  If work on this topic progresses well, a possible objective is to launch a formal standardization of the approach (e.g., in CEN).  

The latter topic is of high interest in several European countries and any European consensus approach with a chance of acceptance necessarily has to include privacy-enhancement.  Note that privacy issues will become more pressing in the future when strong authentication with eIDs will be ubiquitously used in all aspects of our information society in both government and private services.  An prerequisite for such a large-scale use of eIDs is that our strategies include solid concepts of privacy enhancement.  

We are aware of several groups being interested or already working on these topics and attempt to start an effort of early harmonization and consensus building.  

The objective of the March 8 meeting is to form groups of active players that agree to work on these topics and to agree on the objectives and necessary work steps.   While the bulk of work is expected to be done in virtual collaboration over the Internet, we plan to organize also future meetings in person to facilitate progress of work.  

The working groups are open to participation and attempt to follow a pragmatic and result-oriented style of active participation.  Please, feel free to distribute this invitation to possibly interested parties.  

Draft Agenda
--------------------
09:00 - 9:30 : Welcome and explanations of STREAM 1 and STREAM 2

STREAM 1

1. Which ministries were involved in the BELPIC project and what was the role of  them?
2. What was/is the budget of the project?
3. What are the main obstacles encountered since the roll-out? (if they 
are different from the ones which were mentioned earlier coming out from 
the pilot)
4. Business plan
 
STREAM 2

09:30 - 10:30:   Intro to work approach and intro of participants
10:30 - 11:00:  Position Paper: Intro to the UPI approach  (Bruegger, Comune di Grosseto)
11:00 - 11:30:  Position Paper: The Security Layer implementation of UPI (Roessler A-SIT, MODINIS-IDM or Hayat, TU-Graz)
11:30 - 12:00:  Definition of Objectives of the UPI work
     Deliverable:  consensus on objectives
12:00 - 12:30:  initial idea of UPI tasks
     Deliverable:  initial list of task (for later refinement and task assignments)
  
12:30 - 13:30:  LUNCH break

13:30 - 14:00: Introduction to eID privacy enhancement (Meints, Privacy Commission Schleswig-Holstein/FIDIS/PRIME)
14:00 - 14:30: Position Paper:  Sector-Specific PINs in the Austrian Citizencard Concept (Roessler or Hayat)
14:30 - 15:00: Position Paper:  Server-Side Sector-Specific IDs and Partial Identities (Bruegger)
15:00 - 15:30: Definition of Objectives of Privacy-Enhancement work
     Deliverable:  consensus on objectives
15:30 - 16:00: initial idea of Privacy-Enhancement tasks
     Deliverable:  initial list of task (for later refinement and task assignments)
16:00 - 16:30  Decision on Necessary Infrastructure for Virtual Collaboration
     Deliverable:  Commitments necessary to get virtual work going in short term

Meeting Place 
----------------------
meeting will take place
 
e-Forum C/O STERIA Benelux
36 Bd du Souverain 
B-1170 Brussels

HOTELS
 
CROWN PLAZA Brussels City Centre
rue Gineste 3 
1210 Brussels
http://ichotelsgroup.com

CITADINES APART'HOTEL 
Av de la Toison d'or 61-63
1060 Brussels
www.citadines.com
L'Auberge du REPOS DES CHASSEURS
Av Charles Albert 11
1170 Brussels
www.repos-des-chasseurs.com
 
COTE JARDIN (Bead and Breakfast)
Av Leopold Wiener  70
B 1170 Brussels
http://users.swing.be/cote.jardin
 
NO CREDIT CARD ACCEPTED
  
how to get there :
 
http://www.steria.be/tools/route_fr.htm
 
Contact person

Baudouin de Sonis
Executive Director
 
TEL : + 32 (0)2 566 67 83
GSM : + 32 4 75 96 06 28

Background
---------------------

Service Delivery over the Web (UPI)

Often, eIDs are defined in terms of their IAS functionality.  IAS stands for: 
  a.. identification, i.e., data like name, date of birth, national id number, etc. that describe the person 
  b.. authentication, i. e. proof that a valid ID is used by a legitimate user 
  c.. digital signature, i.e. a proof of consent to a transactions or a statement made in some document. 
In the environment of remote service delivery over the web, only for one of these functionalities exists a standardized protocol, namely SSL/TLS in support of authentication.  This protocol is implemented by all major browsers.  

No standard exists for the other two functionalities, leading to a situation where every web application uses a different mechanism.  For example, even the exactly same task may be implemented in different java applets, browser-plugins or active-X controls by different applications.  

This lack of standardization is the cause of serveral problems: 
  a.. difficulty to find multi-platform, multi-browser solutions 
  b.. difficulty to manage multiple solutions in multiple versions 
  c.. lack of a single point of control for 
    a.. security auditing 
    b.. policy enforcement 
    c.. look and feel 
In some more detail, one example that illustrates the difficulties well is digital signature for two different web applications that use different java applets.  Security auditing not only necessary repeatedly for every applet, but it has to be performed on code originating from a remote host.  The only possibility is to establish trust via the signature of the applet.  Since non-expert computer users typically lack the understanding of the concepts involved, it is very easy to get them to accept a hostile applet that is signed by an unknown but good-sounding "authority" (similar to phishing).  

Even more importantly, a highly critical component of digital signature is a "trusted viewer" that guarantees that users actually sign what they believe to sign--nothing different and nothing more.  The very idea to receive a trusted viewer from a remote host in the form of an applet code is rather frightening.  

The enforcement of policy is similarly problematic.  While true that the java virtual machine supports the enforcement of policy, these mechanims are incompletely understood by the average user and confronted with the possibly different needs of multiple applets, users who run into problems of finding a secure combined policy are likely to do anything that gets the applications running--including the removal of important safeguards.  

The probematics of a consistent enforcement of policy is also evident in the fact that different web application can use different technologies to implement the functionality (applets, active-X controls, plugins).  

Finally, the multiple implementations of the same functionality by different web applications make it impossible to achieve a consistent look and feel.  The introduction of new technologies such as digital signature in society is by itself a daunting task;  if key tasks such as trusted viewer or consent to signing look different with every application, the battle is likely lost from the very beginning.  

This discussion illustrates the strong importance of creating a single point of control for the implementation of Identification and digital signature of eIDs.  

The most promising solution that creates such a single point of control is a so called URL Programming Interface (UPI) that exposes the smartcard services through a HTTP interface.  It makes it possible to use HTTP and HTML Forms as only elements of communications between web-application, browser, and smartcard.  These are ubiquitous standards easy to find on all platforms and all browsers.  The UPI approach was originally proposed by Sun Microsystems
Laboratories (http://www.javaworld.com/javaworld/jw-11-1999/jw-11-javadev.html,
http://www.javaworld.com/columns/jw-developer-index.shtml,
http://research.sun.com/projects/dashboard.php?id=45) and has since been adopted by others (e.g.,
http://www.microexpert.com/smartcardurl.html).

This solution is also integral part of the Austrian eID software (security layer):  http://www.iaik.tugraz.at/research/publications/2002/ACSAC2002.pdf
A proof of concept implementation for digital signature of web-forms with UPI has been presented at the Porvoo 8 meeting: http://www.porvoo8.rrn.fgov.be/porvoo8/agenda.php

Possible objectives of the work include 
  a.. achieving consensus of a critical mass of stakeholders, 
  b.. avoiding individual national implementations which need to be harmonized in a later stage, 
  c.. providing a usable interim solution, 
  d.. preparing for formal CEN standardization. 

Possible work items include: 
  a.. problem statement, 
  b.. concept of solution, 
  c.. security analysis, 
  d.. check of patent situation, 
  e.. minimal and advanced specification. 

Server-side privacy enhancement technology

Current eIDs have been designed particularly from the point of view of e-Government and they can be regarded as government-issued identities.  An identity typically comes with a national person identification number or code, in the sequel simply called person ID.  

The full return on investment in the large-scale roll-out of eID cards can only be obtained if government issued eID cards are used as universal means for bringing high levels of authetication and security to all the online-services in all sectors.  This would be a security-revolution of the current Internet and would enable a very large number of services that are currently not possible to offer due to security or privacy risks.  

While a government issued person ID can usually be used without problems in government domains, its use in other sectors such as healthcare or private sectors is usually problematic from a privacy point of view.  The danger is that unrelated data from different sectors become easily linkable based on a person ID.  While this is a cultural judgement, an identity management solution cannot be accepted across Europe unless it uses different person IDs in different sectors, thus avoiding linkability.  

An elegant solution to this problem has been proposed by the Austrian government in the form of a single source ID for a person from which a one-way mapping can derive an unlimited number of sector-specific IDs.  While Austria has implemented this on the client-side, thus breaking with standards such as X.509 and TLS/SSL and currently deployed browsers, there is a possibility of implementing this concept on the server-side, while staying completely compatible with these standards and with the client-solutions currently deployed by various national eID projects.  

-------------------------------------------------------------------------------------------------
Ing. Bud P. Bruegger, Ph.D.                 +39-0564-488577 (voice),  -21139 (fax) 
Servizio Elaborazione Dati                    e-mail:  [email-masked]
Comune di Grosseto                            jabber:  [email-masked]
Via Ginori, 43                                      http://www.comune.grosseto.it/cie/
58100 Grosseto (Tuscany, Italy)           http://www.comune.grosseto.it/interopEID/