Subject: [pkix] Rebooting. WG Action: Conclusion of Public-Key Infrastructure (X.509) (pkix)

From: Anders Rundgren <[email-masked]>
Date: Thu, 07 Nov 2013 21:47:45 +0100

So PKI(X) is finally ready for prime time?

I don't think so.  PKI is still pretty immature as a consumer solution.

The #1 problem is that the process of enrolling PKI (as an alternative to passwords)
haven't gotten much attention until very recently.  Microsoft's "CertEnroll" which has
been a primary blocker for progress in the consumer sector will soon be replaced by
schemes like Google's U2F which aren't bogged down by legacy concepts like ActiveX.

End-to-end secured enrollment will be a standard feature including PIN-code
deployment.  It is neither rocket science nor black magic, only engineering:
http://webpki.org/papers/keygen2/keygen2.junit.run.html#PlatformNegotiationRequest.PINPatterns.1
The link also shows that the bulk of an enrollment protocol can be expressed in clear text using JSON.

Certificate logotypes are now alive and kicking by leaning on a rich key-store model where
keys can be augmented by arbitrary attributes independent of certificate content:
http://webpki.org/papers/PKI/webauth.pdf#page=4

A bit further down the road really exciting concepts may be established, like finally
making secure AND convenient payments on the web a reality:
http://webpki.org/papers/PKI/pki-webcrypto.pdf

Let the fun begin!

Anders

---

From: Stephen Wilson <[email-masked]>
Date: Fri, 08 Nov 2013 09:01:01 +1100

I think it all depends on what you mean by enrollment, and whether 
you're fixated on one particular type of user experience.

PKI at one level is ubiquitous.  There are many examples of consumer 
technology with PKI keys and signing functions embedded: EMV cards, bank 
issued student cards (esp. Banco Santander's), French and German health 
ID cards etc etc.

It goes without saying [or does it?] that "user enrollment" [of the keys 
& certs] for these cards is seamless.

See also the Yubikey. I think that's got a big future.  Driver-less 
PKI-based 2FA.

But if you want the consumer experience to be private-keys-in-your-face, 
like the 1990s nonsense about digital signatures being the equivalent of 
handwritten signatures, non-repudiation blah blah blah then yes, I 
suppose someone needs to do more "work" on "enrollment".  I don't know 
why you'd bother.

Cheers,

Steve.

NB, new job:

Steve Wilson | VP & Principal Analyst | Constellation Research, Inc.
Voice:+61 (0)414 488 851 | Twitter: @steve_lockstep | Skype: 
stephen.lockstep

On 8/11/2013 7:47 AM, Anders Rundgren wrote:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>

---

From: Anders Rundgren <[email-masked]>
Date: Fri, 08 Nov 2013 06:30:39 +0100

On 2013-11-07 23:01, Stephen Wilson wrote:
> 
> 
> 
> I think it all depends on what you mean by enrollment, and whether you're fixated on one particular type of user experience.

I'm referring to all kinds applications involving client-side PKI in conjunction with end-user computers like
- Mobile banking
- All forms of BYOD
- NSTIC

> 
> PKI at one level is ubiquitous.  There are many examples of consumer technology with PKI keys and signing functions embedded: EMV cards, bank issued student cards (esp. Banco Santander's), French and German health ID cards etc etc.

Sure, but EMV-cards never did it on the Internet in end-users' computers unless you count EMV-based OTP + 3D Secure which I personally consider the worst payment system ever.

Anyway, with a few exceptions there are few overlaps here.
But you never know what will happen when half of the earth's population carries PKI-enabled phones.
ICAO's attempt to put your entire travel dossier (updatable by all border controls!!!) in e-passports appears insanely difficult compared to just keeping your latest visas, etickets etc in you phone.

> It goes without saying [or does it?] that "user enrollment" [of the keys & certs] for these cards is seamless.
> 
> See also the Yubikey. I think that's got a big future.  Driver-less PKI-based 2FA.

http://www.yubico.com/2013/05/google-yubico-join-fido/

We'll see about this driver-less thing ;)
Currently you need to sign an NDA and pay some $15 000 to get the spec so we have to stay tuned...

> 
> But if you want the consumer experience to be private-keys-in-your-face, like the 1990s nonsense about digital signatures being the equivalent of handwritten signatures, non-repudiation blah blah blah then yes, I suppose someone needs to do more "work" on "enrollment".  I don't know why you'd bother.

If the private keys are in a device you own (phone), this use-case also need a face-lift.
My guess is that the combination of NFC and an Internet-based enrollment scheme will allow you to issue virtual cards with the same security level as today but at a fraction of the cost since there is no manufacturing to do.

Cheers,
Anders

> Voice:  +61 (0)414 488 851 | Twitter: @steve_lockstep | Skype: stephen.lockstep
> 
>