Subject: Re: draft-santesson-pkix-certimage-00.txt: any example to date?

From: "Bajaj, Siddharth" <[email-masked]>
Date: Mon, 11 May 2009 15:50:53 -0700

PKIX-folks, 
 
I would like to offer my support for Stefan's draft. I've worked for a
large CA for the last 10 years
and see this work as an important 'building block' in addressing the
usabillity issues with 
client certificates. 
 
At VeriSign, we worked on an ActiveX control/Java plug-in called the
Personal Trust Agent (PTA)
over 10 years ago. Among other things it tried to provide a visual
representation of a certificate
that tried to mimic the physical forms of identity that the user is
familiar with - driver's license, 
credit cards, etc. This solution was used in large deployments by many
financial institutions, 
mainly outside the US. 

 
More recently, we have seen the emergence of the 'Infocard' paradigm
that also tries to provide
a visual representation of a digital identity that mimics the physical
identity cards that the user is
familiar with, through Card Image. 
 
Stefan's proposal is powerful because it can provide a standardized and
user-friendly metaphor 
for representing certificates in various UI contexts. 
 
This draft will also serve to bring the different underlying
technologies such as Cardspace and 
X.509 certificates closer together in terms of the user experience - by
using the similar visual 
metaphors to represent the user's credential/identity. 
 
Thanks,
 
Siddharth
Principal, Innovation,
VeriSign, Inc.

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 12 May 2009 20:57:17 +0200

Siddharth,

For the record:

There is an entirely different way of achieving the functionality you and others [rightfully] 
request:
http://webpki.org/papers/web/multiple-credentials-in-the-enterprise.pdf

This scheme has (like all methods) certain pros and cons:

Pros
- No privacy issues (no "publishing")
- Perfect match with the device GUI through a negotiating protocol
- Does not require CAs keeping myriads of logotypes on-line
- Also supports thumbprint images for usage in menus
- Covers the entire spectrum of 2FA (Two Factor Authentication) credentials

Cons
- Requires adoption of KeyGen2

Is the latter a problem? Of course it is, but it is anyway needed in mobile
phones unless the following is what PKIX [de-facto] prescribe:
http://www.trustdigital.com/downloads/TD_EMM_CAC_Pack_101008.pdf

KeyGen2 + a 50 cent built-in TPM securely emulates $200+ worth of highly
inconvenient c**p, requiring the kind of proprietary middleware which everybody
who has ever toyed with smart cards, know is a real PITA.  Unlike the
card solution, The KeyGen2+TPM combo supports multiple issuers making
the cert-image even more interesting.  cert-images can hardly be very important
in a situation where you just have a single credential.

Anders

----- Original Message ----- 
From: Bajaj, Siddharth
To: [email-masked]
Sent: Tuesday, May 12, 2009 00:50
Subject: Re: draft-santesson-pkix-certimage-00.txt: any example to date?

PKIX-folks,

I would like to offer my support for Stefan's draft. I've worked for a large CA for the last 10 
years
and see this work as an important 'building block' in addressing the usabillity issues with
client certificates.

At VeriSign, we worked on an ActiveX control/Java plug-in called the Personal Trust Agent (PTA)
over 10 years ago. Among other things it tried to provide a visual representation of a certificate
that tried to mimic the physical forms of identity that the user is familiar with - driver's 
license,
credit cards, etc. This solution was used in large deployments by many financial institutions,
mainly outside the US.

More recently, we have seen the emergence of the 'Infocard' paradigm that also tries to provide
a visual representation of a digital identity that mimics the physical identity cards that the user 
is
familiar with, through Card Image.

Stefan's proposal is powerful because it can provide a standardized and user-friendly metaphor
for representing certificates in various UI contexts.

This draft will also serve to bring the different underlying technologies such as Cardspace and
X.509 certificates closer together in terms of the user experience - by using the similar visual
metaphors to represent the user's credential/identity.

Thanks,

Siddharth
Principal, Innovation,
VeriSign, Inc.