Subject: RE: QC's - for human eyes only?

From: Ilan Shacham <[email-masked]>
Date: Mon, 6 Dec 1999 09:43:45 +0200

Stephen,
Comments inline.

> Ian & Anders,
That's Ilan... :-)
> 
> We had this discussion a year ago, as Anders noted.  We did not 
> choose to put biometric data in certs because such data is large, 
> because its inclusion in a cert potentially exposes it to 
> unauthorized acquisition, and because it is not generally required.

All of these arguments may be true today, but will probably not be
true tomorrow, and are certainly application specific. Therefore
I think we should leave the option to include the biometric data
inside the certificate, and let the application engineers make
storage and security considerations, considering the biometry type,
technologies involved and the specific application.
If we are looking at the security side, I can see network access to 
biometric data as an opening to denial of service attacks.

> In general, biometric user authentication is NOT a good idea for 
> remote authentication.  Anders made a persuasive argument for 
> inclusion of a reference to such data in the case when a person will 
> evlauate a human supplied biometric.  His arguments were not 
> persuasive enough to warrant inclusion of the biometric data in the 
> cert per se, nor in more general biometric contexts.  This is not a 
> function of the quality of the biometrics involved, but a fundamental 
> issue with any biometric.

True, Biometric data has no meaning remotely, that's why I don't see
why a in order to verify a person carrying a digital ID card I should
need anything but the information on the card itself. I also don't
see why, if technology permits it, I shouldn't be able to be machine
authenticated.

> Steve

My main point is that it seems that we are shutting the door on options
that technology will soon make available. Standards we are etching here
take a long time until they are well accepted in the market, our job is
to look forward at the needs of the market for today and for the 
following years. We don't have to do the specifics of stuff we can't
yet work out, but at least leave a good opening for those specifics.

Ilan

---

From: Denis Pinkas <[email-masked]>
Date: Mon, 06 Dec 1999 11:45:38 +0100

Ilan,

Stephen gave the right answer. We should not re-open that
discussion. We are not "shutting the door on options that technology
will soon make available". The Version 3 of X.509 certificates
allows to define other extensions. The one you are requesting could
be defined later, when it becomes appropriate.

Denis