Slight return on the Gateway PKI

["Anders Rundgren" <anders.rundgren@telia.com>]

Currently most Telcom operators and Electricity companies crank out paper-invoices in fully automated processes.  Only the actual delivery of by snail-mail involves humans.

 

Now, lets assume that these parties would turn to e-invoices and PKI, how would you expect these invoices to be signed?  There are two variants:

• Like the US Government (read: NIST) and the Germans suggest: Companies hires additional employees that equipped with smart cards, sign individual invoices.  Actually the Germans are ahead of the US since they now have a technical facility that lets a single user sign with a dozen smart cards.  This way they reduce the need for additional staff with some 90%
  
• The invoicing companies simply modify their backend systems to automatically "sign" (instead of "print") on behalf of the organization using a $500/Y Gateway PKI certificate, issued by a major TTP.

 

I don't think that the commercial enterprises have any major problem of selecting method.  Since Gateway PKI also scales trust-wise at least 100 times better than enterprise-PKI, receivers will experience few problems with unknown trust anchors.

 

 

Anders Rundgren