More on PKI four-corner models

["Anders Rundgren" <anders.rundgren@telia.com>]

Extracts from internet-payments list (FSTC)

  "The four corner model is a valid business model with all four parties
   filling a valid business role .... totally independent of whether the
   delivery vehicle involves offline, stale, static certificates."

 

On the contrary.   If the TTP (credential issuer) is a part of a trust-network, the fourth corner (acquirer) is redundant as there is nothing a fourth party can add but costs[1].  That is, if we talk about authentication, and not about the transferal of money.

 

1] Including:

- Subscription fees

- Transaction fees

- Proprietary trust network software

- Relying party credential issuance and configuration

- Trust network arbitration software

 

I claim that the Four Corner model is the single most hampering thing to wide-scale PKI-deployment because it makes receivers' possibly pay for messages that they maybe did not even wanted!

 

In  paper-based messaging (excluding all kinds of payment systems), the "sender" typically puts on a stamp on a letter to get it distributed.  This makes sense, four-corner does not.

 

May I end this letter citing an interview with Bill Gates?

 

Q: In 1995, you wrote in your book, "The Road Ahead," that IT will realize friction-free capitalism by excluding middlemen and directly connecting buyers and sellers. Do you still believe in the idea?

A: Oh absolutely. I believe there should be no markup in any area of the B2B marketplace. If you want to buy and sell from anyone in the world, you should just get very inexpensive software. They'll let you see every seller and let you do complex transactions without anybody marking up the cost of what you're buying. XML Web services are needed for that, and that's what we're doing. It's a key building block of friction-free capitalism.

 

Anders Rundgren

Consultant, PKI and e-infrastructure