W3C home > Mailing lists > Public > public-identity@w3.org > August 2011

Re: W3C's Enrollment Specification

From: Anders Rundgren <anders.rundgren@telia.com>
Date: Sat, 06 Aug 2011 12:35:22 +0200
Message-ID: <4E3D18EA.8040007@telia.com>
To: Henry Story <henry.story@bblfish.net>
CC: "public-identity@w3.org" <public-identity@w3.org>
On 2011-08-06 12:22, Henry Story wrote:
>>> Can you fill be in again here? I feel like there is something I am missing here, and I would
>>> like to fill in the whole in the wiki above.
>> That's absolutely correct, you get nowhere with a certificate without
>> the matching private key.  In fact, the PoP (Proof-of-Possession) schemes
>> featured in enrollment schemes are redundant. Attestations of the kind
>> there are in ETSI/3GPP and TCG protocols OTOH, actually fills a purpose
>> since they identify the key-container.
> Ah you mean the crypto key, or the telephone keychain?

The origin of this is the telecom and banking communities who want to
be assured that keys reside in a container of their liking (SIM,
"Carte Bleu" etc).

> I suppose that is nice if you want to tie someone to a device, 

It is actually more than nice because it eliminates enrollment passwords.
1. Sign up. create a request
2. An issuer asks you about the device ID
3. After verification the request can be approved

> but problematic if you want more self asserted identity for privacy reasons. 
> It could be that there is space for both schemes.

Yes, indeed.  I recently added PEP (Privacy Enhanced Provisioning) as an option
in SKS/KeyGen2 to please both "camps" :-)

>>> By the way I don't see how what Apple is doing could have a better user interface.
>>> The user interface for keygen is: click a button. Unless they move to mind reading...
>> Well, user-interface is just one aspect but if we concentrate on that one, Apple's
>> solution eliminates the confusing strong/weak button.
> Agree, the strong/weak button should just be a hint. Mind you it could be thought of that
> way. Opera gives way too many options there, Other browsers give much fewer. So it would
> not be impossible to have a browser just give none. Work to eliminate that button to
> everyone's satisfaction would certainly be welcome.

That would be a better thing than the MD5 enhancement.

A slight problem is that Microsoft doesn't accept <keygen>.


>> Anders
>>> Henry
>>>> Anders
>>> Social Web Architect
>>> http://bblfish.net/
> Social Web Architect
> http://bblfish.net/
Received on Saturday, 6 August 2011 10:35:58 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 6 January 2015 20:00:47 UTC