Subject: [pkix] NSTIC delayed - FIPS201 contributed

From: Anders Rundgren <[email-masked]>
Date: Wed, 22 Dec 2010 13:28:22 +0100

http://www.digitalidnews.com/2010/11/18/national-strategy-delayed

Apart from the political concerns the fact is that the technology
needed isn't available.  NIST didn't specify an on-line-oriented
provisioning method for FIPS201 which greatly limits this concept
in the consumer space.  Physical card distribution is so 199X.

But there is no need to despair because Apple is fixing the "hole":

http://www.smartcardstrends.com/det_atc.php?idu=13258

In addition to HW-protected keys they will have E2ES (End to End Security)
schemes for key provisioning, *presumably* run through the browser.

I believe this could turn out to be the most significant happening in the
IDM-field since the introduction of SAML.

Imagine a world without third-party middleware, non-standard devices
like card readers, fuzzy cabling, and smart card integrators;
only pure functionality that can be used by just about anybody.

Regards,
Anders

---

From: Stephen Wilson <[email-masked]>
Date: Thu, 23 Dec 2010 05:29:58 +1100

I wouldn't get too excited about Apple doing anything smart in this 
space.  AFAIK they still haven't announced their S/MIME plans for the 
iPhone, which in part continues to put it behind Blackberry in the 
corporate market.  Apple needs signing, certificates and WPKI but they 
don't seem to rate these as important features.  If they ever get around 
to supporting certificates, I fear that (a) they will only offer them 
through the iStore, and (b) they will think you only need one (theirs).

"iCert"?

iDontThinkSo.

Cheers,

Stephen Wilson
Managing Director
Lockstep Group

Phone +61 (0)414 488 851

www.lockstep.com.au <http://www.lockstep.com.au>
Lockstep Consulting provides independent specialist advice and analysis
on digital identity and privacy.Lockstep Technologies develops unique
new smart ID solutions that enhance privacy and prevent identity theft.

On 22/12/2010 11:28 PM, Anders Rundgren wrote:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>
>

---

From: max pritikin <[email-masked]>
Date: Wed, 22 Dec 2010 13:13:52 -0600

The iphone supports certificates for VPN. They can be installed a  
number of ways (including the SCEP protocol).

This is not a general PKI issue - this is more specific to the storage  
method (e.g. HW-protected keys) and the mail client implementation.

- max

On Dec 22, 2010, at 12:29 PM, Stephen Wilson wrote:

> space.  AFAIK they still haven't announced their S/MIME plans for  
> the iPhone, which in part continues to put it behind Blackberry in  
> the corporate market.  Apple needs signing, certificates and WPKI  
> but they don't seem to rate these as important features.  If they  
> ever get around to supporting certificates, I fear that (a) they  
> will only offer them through the iStore, and (b) they will think you  
> only need one (theirs).
>
> "iCert"?
>
> iDontThinkSo.
>
> Cheers,
>
> Stephen Wilson
> Managing Director
> Lockstep Group
>
> Phone +61 (0)414 488 851
>
> www.lockstep.com.au
> on digital identity and privacy.  Lockstep Technologies develops  
> unique

---

From: Stephen Wilson <[email-masked]>
Date: Thu, 23 Dec 2010 06:48:51 +1100

Max,

Are you sure it's not a "general PKI" issue?  It seems to me that the OS 
does not have the necessary general purpose crypto libraries and APIs to 
manage certificates on a SIM or anywhere else, nor to sign objects.  Is 
it actually possible to implement S/MIME on the current OS?

Cheers,

Stephen Wilson
Lockstep
www.lockstep.com.au

On 23/12/2010 6:13 AM, max pritikin wrote:
>> corporate market.  Apple needs signing, certificates and WPKI but 
>> they don't seem to rate these as important features.  If they ever 
>> get around to supporting certificates, I fear that (a) they will only 
>> offer them through the iStore, and (b) they will think you only need 
>> one (theirs).
>>
>> "iCert"?
>>
>> iDontThinkSo.
>>
>> Cheers,
>>
>> Stephen Wilson
>> Managing Director
>> Lockstep Group
>>
>> Phone +61 (0)414 488 851
>>
>> www.lockstep.com.au
>> on digital identity and privacy.  Lockstep Technologies develops unique

---

From: max pritikin <[email-masked]>
Date: Wed, 22 Dec 2010 14:09:19 -0600

On Dec 22, 2010, at 1:48 PM, Stephen Wilson wrote:

>
> Max,
>
> Are you sure it's not a "general PKI" issue?  It seems to me that  
> the OS does not have the necessary general purpose crypto libraries  
> and APIs to manage certificates on a SIM or anywhere else, nor to  
> sign objects.

What I mean is that it appears to have the general purpose crypto  
libraries and APIs (to "Create, manage and read certificates", "Add  
certificates to a keychain", "Sign data and verify signatures" etc) as  
part of the the Core Services / Security Services iOS layers. This API  
layer apparently calls down to a "Common Crypto" library which they  
diagram as being part of the "Core OS". Obviously these layer names  
are arbitrary.

>  Is it actually possible to implement S/MIME on the current OS?

My point is that from the application layer implementing S/MIME seems  
entirely possible. I don't expect an implementation from them but I  
don't see why an independent developer couldn't provide such a tool.  
(I'm ignoring Apple app-store restrictions on competitive products and  
stuff. That is a whole different topic).

What I don't see any mention of is a HW-keystore. I fully agree Apple  
is unlikely to add such a thing anytime soon but if they did so it  
could occur at those lower layers and be available to all apps. It  
would seem their software architecture would handle it just fine, and  
would fully support multiple certs from independent vendors etc etc,  
just like any other computer out there.

Thus I see this as a specific HW limitation not a general PKI issue. I  
don't know the capabilities of the Embedded USIM referenced in the  
original post nor, obviously, do I have any clue how Apple plans to  
leverage those capabilites.

- max

>> This is not a general PKI issue - this is more specific to the  
>> storage method (e.g. HW-protected keys) and the mail client  
>> implementation.
>>
>> - max
>>
>>> I wouldn't get too excited about Apple doing anything smart in  
>>> this space.  AFAIK they still haven't announced their S/MIME plans  
>>> for the iPhone, which in part continues to put it behind  
>>> Blackberry in the corporate market.  Apple needs signing,  
>>> certificates and WPKI but they don't seem to rate these as  
>>> important features.  If they ever get around to supporting  
>>> certificates, I fear that (a) they will only offer them through  
>>> the iStore, and (b) they will think you only need one (theirs).
>>>
>>> "iCert"?
>>>
>>> iDontThinkSo.
>>>
>>> Cheers,
>>>
>>> Stephen Wilson
>>> Managing Director
>>> Lockstep Group
>>>
>>> Phone +61 (0)414 488 851
>>>
>>> www.lockstep.com.au

---

From: Stephen Wilson <[email-masked]>
Date: Thu, 23 Dec 2010 07:19:50 +1100

I see what you mean.

Thanks Max.

Cheers,

Steve.

On 23/12/2010 7:09 AM, max pritikin wrote:
>> Are you sure it's not a "general PKI" issue?  It seems to me that the 
>> OS does not have the necessary general purpose crypto libraries and 
>> APIs to manage certificates on a SIM or anywhere else, nor to sign 
>> objects.
>
>>>> will only offer them through the iStore, and (b) they will think 
>>>> you only need one (theirs).
>>>>
>>>> "iCert"?
>>>>
>>>> iDontThinkSo.
>>>>
>>>> Cheers,
>>>>
>>>> Stephen Wilson
>>>> Managing Director
>>>> Lockstep Group
>>>>
>>>> Phone +61 (0)414 488 851
>>>>
>>>> www.lockstep.com.au

---

From: Anders Rundgren <[email-masked]>
Date: Wed, 22 Dec 2010 22:19:54 +0100

The "master plan" is to enroll SIMs on-line.

Together with Apple's recent hirings of payment professionals, this is
already sending shock-waves not only through the smart card industry,
but on operators and banks as well.  Apple is presumable after PayPal's
scalp...

I think this is good because it will increase the innovation level
in a segment that has been virtually free from advances since their
*regular* customer base pretty much doesn't ask for it.

A GlobalPlatform card is able to PKI, SIM, OTP and whatever you like.
The most interesting will be the built-in card enrollment system.

Naturally this is close to trivial when you have all pieces in one box.

Calling this "soft-SIMs" is somewhat wrong, the SIMs are exactly as hard
as ordinary SIMs it is just the enrollment that is soft.

Anders

> 
> The iphone supports certificates for VPN. They can be installed a number 
> of ways (including the SCEP protocol).
> 
>> don't seem to rate these as important features.  If they ever get 
>> around to supporting certificates, I fear that (a) they will only

---

From: "Miller, Timothy J." <[email-masked]>
Date: Mon, 27 Dec 2010 15:34:35 -0500

Anything's possible.  Good Technology has a working S/MIME stack on iOS 4.  Apps can do a lot on their own, but they can't provide service extensions of the OS.

This is probably no longer apropriate for the PKIX list.

-- T

From: [email-masked] [[email-masked]] On Behalf Of Stephen Wilson [[email-masked]]
Sent: Wednesday, December 22, 2010 1:48 PM
To: pkix
Subject: Re: [pkix] NSTIC delayed - FIPS201 contributed

Max,

Cheers,

Stephen Wilson
Lockstep
www.lockstep.com.au