Subject: RE: QC's - for human eyes only?

From: Anders Rundgren <[email-masked]>
Date: Mon, 6 Dec 1999 08:53:46 +0100

Steve,

The URI biometric solution does the same thing (information-wise) as in-line biometric data, but
in a "crummy" way.  If there is any defined way to discriminate access to the URI, this
information is surely not possible to find in the QC draft.  Note that such information have
been requested by me several times.  No answer - or "implementation defined".

In-line biomterics and finger-prints are just another implementor's option.  If it is
good or bad is outside of the scope of the standard.

If someone really needs "DiameterOfRectum" [he surely must be an A** H**E :-) :-) ] and can prove
that there is an entire industry (in analogy with finger-prints) interested in this.  Why not add it?

The solution in the commercial world will be that this is solved by extensions.
Is this what you/we/all want?

Anders

----------
From:  Stephen Kent [SMTP:[email-masked]]
Sent:  Sunday, December 05, 1999 22:52
To:  Anders Rundgren
Cc:  Ietf-Pkix (E-mail); SEIS-listan
Subject:  RE: QC's - for human eyes only?

Ian & Anders,

We had this discussion a year ago, as Anders noted.  We did not 
choose to put biometric data in certs because such data is large, 
because its inclusion in a cert potentially exposes it to 
unauthorized acquisition, and because it is not generally required.

In general, biometric user authentication is NOT a good idea for 
remote authentication.  Anders made a persuasive argument for 
inclusion of a reference to such data in the case when a person will 
evlauate a human supplied biometric.  His arguments were not 
persuasive enough to warrant inclusion of the biometric data in the 
cert per se, nor in more general biometric contexts.  This is not a 
function of the quality of the biometrics involved, but a fundamental 
issue with any biometric.

Steve

---

From: [email-masked]
Date: 06 Dec 1999 10:13:55 Z

Hi!
I've been a "listener" on the SEIS mailing list for some time now, but as I am not a specialist 
in certificate design, I did not write to it.
However, the work you do in PKIX on QC, warrants some comment from potential "market". I 
represent a part of this market - the public sector in Norway. I've been responsible for 
establishing  naming rules for certificates for the Norwegian public sector.
I have two comments in connection with the QC-debates on unique identity and biometrics:
1. Using "serialnumber" for unique identifier seems to be a strange idea for denominating 
humans and organizations (we have unique numbers for both in Norway, but we put them in 
dnQualifier or in the O-field following the name itself); dnQualifier makes much more sense 
for a "common user" than "serialnumber" (this is more appropriate for devices)
2. Inserting biometrics in certificates is NOT a very good idea in terms of personal data 
protection - no matter how "secure" it might be made, the users won't have it (I would never 
accept this as a user - I want my biometrics on the smartcard!).
I don't know whom do you refer to when you speak about "the market", but it might be more 
complex than you seem to think.
Katarina de Brisis
____________________________________________________________________
Katarina de Brisis, senior adviser, Royal Ministry of Labour and Government 
Administration, P.O. Box 8004 Dep., 0030 Oslo
Phone + 47 22 24 46 46 Fax + 47 22 24 95 17
Internet e-mail [email-masked]