OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

pki-tc message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [pki-tc] Measuring the success of PKI [was: PKI-TC charter issue]


I think you and I might be closer in our views than it appears.  I think 
the future of PKI is embedded digital certificates.  When I said that 
ubiquitous use of digital signatures by the general public need not be the 
best way to measure PKI's success, I meant to say "overt" digital 

But I too see embedded PKI, delivered via EMV and other types of 
smartcards and portable devices, as taking over. 

I wrote a paper for the American Bar Association about this a little while 
ago.  See www.abanet.org/scitech/nosearch/eblast/eblastarticle1.html and 
an extract below. 




PKI without tears
January 2003 


Traditional Public Key Infrastructure (PKI) is unnecessarily complicated. 
Largely as a result of early misconceptions that we needed an all-purpose 
digital passport to do business on the Internet, traditional PKI has 
become overloaded with invasive personal identity checks and complex legal 
arrangements. To make things worse, early software implementations brought 
out explicit details of digital certificates, necessitating unusually 
intense user training. To try to support stranger-to-stranger 
transactions, user agreements for general purpose certificates have 
required people to read and understand huge and forbidding Certification 
Practice Statements. And yet the business benefits of going to all this 
trouble remain controversial. 

Most of the burden of orthodox PKI derives from trying to create the all-
purpose digital identity. In day-to-day personal commerce, this is 
famously analogous to a drivers licence, but in the professions and in 
business, a single identity is uncalled for and unprecedented. PKI tends 
to deliver its greatest benefits – automatic paperless processing, reduced 
legal risk, lower cost of dispute resolution – in high value, high volume, 
specialist applications, where digital personae are application-specific.

There are new PKI models where the cryptography is embedded deeply into 
smartcards, to much the same extent that complex ferromagnetic technology 
is built into all the other plastic cards we take for granted. Application 
software can be engineered so that all digital certificate functions are 
automated; smartcards can be issued to professionals and business people 
under existing terms and conditions which reflect the users’ standing. The 
user experience then becomes the same as with any conventional access 
card. We can do away entirely with the need to read and understand complex 
Certification Practice Statements and Policies, sign up to unusual 
Subscriber and Relying Party agreements, or undergo esoteric technical 
training. Thus the underlying PKI becomes true infrastructure, used purely 
to automate paperless transactions between parties who are already 
accustomed to dealing with one another. 

This paper presents a fresh look at the business drivers and true benefits 
of digital signatures, and shows how application-specific PKI can deliver 
the benefits with better usability, zero registration overhead, reduced 
training costs, simpler liability arrangements, and streamlined 
accreditation. The paper is aimed at regulators, policy analysts and e-
business strategists with an interest in the future of PKI. 


> c-i-l
> Stephen wrote:
> >Sorry Anders, I am not totally sure what you mean by "web sign".  Do 
> >mean applying digital signatures in thin client web apps?
> The following is a fairly good description of web sign.  Page #6 is the 
actual definition.
> http://web.telia.com/~u18116613/onlinesigstdprop.ppt
> >Personally I think that XMLsignatures is the key here, allowing more 
> >implementation of digital signatures in simple web forms. 
> Absolutely.
> >We don't see a  lot of this yet for two reasons: (1) penetration of XML,
> >and (2) more  importantly, we're in a PKI lull at the moment where 
developers and 
> >architects don't see the point of doing dig sigs at all (which then 
> >reinforces the slow uptake of XMLsignatures). 
> I cannot verify this.  XML is huge.  XML signatures is in good use.  But 
it is
> mostly happening on the server side as the client platform is still 
> <snip>
> >But why should we measure the success of PKI by the percentage of the 
> >general public using it?
> It is at least one way to measure.  By doing that I would say that Sweden
> is about FOUR MAGNITUDES more successful than the US :-)
> >By its very nature it's not a ubiquitous  technology.  
> I don't agree a single bit on that.  PKI will long-term become
> more used than passwords for on-line services.
> >A very big obstacle we all need to get over is the long 
> >lasting misconception that PKI would (or should be) be ubiquitous. 
> Since 50% of the entire Swedish population can get a PKI cert
> today, I have some problems with this statement of yours.  Maybe
> you refer to the universal use of a specific PKI? That's another issue
> in my opinion.  Which I agree on BTW.
> >We (as PKI advocates in the TC) I think should be very happy if we were 
to see 
> >PKI penetrate say 5% of the population, as long as it was the right 5%, 
> We are as I told you far ahead of this goal already.  With EMV cards
> for payments using PKI we get some 35% penetration of a special
> purpose PKI.
> >and led to major improvements in the way certain types of e-business -- 
> >not all e-business -- is carried out. 
> IMHO all e-business can without doubt benefit from using PKI
> *technology* but that involves everything from EMV payments in
> a shop to server-signed B2B POs.
> What kind of e-business would not gain by using PKI technology?
> <snip>
> >But there are countless applications where signatures are most 
> >required.  In Australia, large consulting projects in a wide range of 
> >fields including medical prescriptions, pension funds management, and 
> >real estate industry, have analysed in detail the hundreds of instances 
> >where the law here requires a person to sign something.  Very few of 
> >instances can be nicely automated online without PKI. 
> I believe you are limiting the use of signatures by connecting it to law.
> Digital signatures is a way to show intent.  That is, you can indeed
> sign up for a dentist appointment using signatures.  This is already
> implemented in Sweden.
> <snip>
> >These are reasons for why internet banking with PKI is difficult, but 
> >point is that internet banking with PKI is not necessary.  The reason 
> >that internet retail banking works using the same rules as phone 
> Now you are into this legal business again.  PKI should be
> compared to long passwords and OTPs.  PKI is MUCH more convenient
> as well as withstands any amounts of server-break-in attempts.
> Passwords and OTPs typically lock the account after a few consecutive 
> That could cost tons of money.
> Signatures actually combine an intent (transaction request) with a
> procedure and security and is IMO useful for paying simple
> bills.  If the signature software is appropriate that is.  I do
> this all the time actually...
> >It is often said that PKI is better for business banking and indeed I 
> >seen reasonably good applications in treasury functions etc.  This is 
> >because these more complicated transactions tend to need signatures 
> >because the economics can cope with relatively more expensive software 
> >development and support issues like smartcard reader deployment). 
> I do not agree.  It is volume apps that benefit from PKI.  Things that
> you only do occasionally you might as well do the conventional way.
> But I of course again see this from a consumer perspective which is
> due to the fact that in EU, PKI is mostly a consumer movement.
> >The other important point in email is that really good PKI apps do not 
> >involve transactions between total strangers, but instead involve 
> >which have a prior business relationship, which is readily instantiated 
> >the form of a certificate issued by one of the parties to the other.  
> >example, a certificate standing for someone's qualification as a patent 
> >lawyer, or a licenced customs broker, or a registered medical 
> >practitioner.  The idea that you can determine a total stranger's 
> >trustworthiness from reading their digital certificate is not 
> >indeed is almost fanciful.  
> Violently agree!
> >Anders, I don't think implementing PKI always requires reworking all 
> >business processes and logic. In fact, the better PKI apps succeed by 
> >being overlaid on business processes without changing them.  For 
> >if a paper medical prescription process works by writ of a doctor's 
> >licence to practice, then it's very smooth and efficient to issue a 
> >digital cert to the doctor that simply represents her medical 
> >(say with the medical authority acting as RA) and to apply digital 
> >signatures in e-prescribing software.  Usually this software is fat 
> >client, updated every quarter or so with a new version, and easily 
> >mopdified to call up some dig sig functions. 
> One problem is when this e-prescription is about to be transferred to
> the pharmacy because message encryption which is a necessity in
> this sector is incompatible with everything else. 
> http://w1.181.telia.com/~u18116613/A.R.AppliedPKI-Lesson-1.pdf
> The following is a real example of e-health worth studying:
> http://middleware.internet2.edu/pki05/proceedings/kailar-phinms.ppt
> If individual signatures were to be added, they should (IMO)
> be stored locally together with other audit info.
> In fact, here I believe this TC is on the wrong track.  But "fortunately"
> this TC is in very good company, there are numerous other "PKI-TCs"
> and they all refuse to acknowledge the notion that an information
> system can be "authorative".   We, the system architects have worked
> with this "paradigm" since day #1 and see no reason to change. 
> On the contrary, this is a wonderful way to create a scalable PKI. 
> There is a reason why VeriSign have 1 billion relying parties for their
> SSL CA as well as a million paying subscribers!
> Here you already have a truly ubiquitous PKI BTW.
> Cheers
> Anders Rundgren

<Put email footer here>

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]