Subject: RE: Online PIN & Server Wallet

From: Anders Rundgren <[email-masked]>
Date: Mon, 13 Dec 1999 10:08:05 +0100

Lyal,

>- Why not have the Server wallet sign on behalf of the cardholder? - they've
>already authenticated themselves by PIN, thuis no need for a personalised
>certificate.

Well, your are right about the server-signature but if you put this statement in the 
IETF-PKIX-list you will get return messages like "not secure", "breaks the intention of PKI" ,
"the user-environment and equipment is more trustworthy than a server" etc.

Naturally these guys will simply be ignored, as today you get computer-generated invoices on
company-papers from energy companies and Telcos. When (if) they convert this into PKI,
I doubt that they will add a human clerk to push "OK" or key PIN-codes for each outgoing
digitally signed invoice.

I do believe though that it would be advantageous (but not absolutely necessary) that users also
performs a signature operation, preferably with the same device and mechanism as they do for
their Internet-banking account.  Here assuming that the server wallet is located at the user's bank
which though may not always be the case.  Some Internet-banks do not require signing yet, and
in those cases your original idea is exactly as good (or bad) as their on-line banking services.

Anders

---

From: "Lyal Collins" <[email-masked]>
Date: Tue, 14 Dec 1999 07:26:42 +1100

Who cares about "not in the spirit of PKI"?

The end result of what I described is the same, and it is no less secure
than  the password at keyboard models most think we can use 'safely'

I want to see affordable implementations and affordable operational models
for PKI, otherwise, don't waste our time with it.

Regards,
Lyal
> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Anders
> Rundgren
> Sent: Monday, 13 December 1999 20:08
> To: [email-masked]; 'Lyal Collins'
> Cc: [email-masked]'; 'Matei (DSV)'
> Subject: RE: Online PIN & Server Wallet
>
>
> Lyal,
>
> -----------------------------------------------------------------------
> Message addressed to: [email-masked]
> Archive available at: http://lists.commerce.net/archives/set-discuss/
> To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
> body to: [email-masked]
>

---

From: "Phillip M Hallam-Baker" <[email-masked]>
Date: Mon, 13 Dec 1999 18:37:48 -0500

> for PKI, otherwise, don't waste our time with it.

I thought that was the spirit of PKI!

If I get a bill from my telco it is the telco that is authenticating
itself to me as a corporate entity, not Kent the Clerk.

One of the problems with the endless (and more than tedious) discussions of
non repudiation and biometrics that infest the list could be avoided if
people would recognize that:

1) The objective is to _control_ risk. Eliminating every possible threat is
	not necessary to achieve that objective.

2) Non repudiation is not a binary property. It is not a question of having
	NR or not having it but one of degree.

3) Corporations do not have biometrics.

		Phill

---

From: "Lyal Collins" <[email-masked]>
Date: Tue, 14 Dec 1999 11:23:46 +1100

I would have phrased it "control risk cost effectively".
AADS is the nearest I have seen to a cost effective PKI model, the rest cost
too much to implement and to operate.

Lyal

> From: Phillip M Hallam-Baker [mailto:[email-masked]]
> Sent: Tuesday, 14 December 1999 10:38
> To: Lyal Collins; [email-masked]
> Cc: [email-masked]