- From: Anders Rundgren <anders.rundgren@telia.com>
- Date: Sat, 06 Aug 2011 12:35:22 +0200
- To: Henry Story <henry.story@bblfish.net>
- CC: "public-identity@w3.org" <public-identity@w3.org>
On 2011-08-06 12:22, Henry Story wrote: <snip> >>> Can you fill be in again here? I feel like there is something I am missing here, and I would >>> like to fill in the whole in the wiki above. >> >> That's absolutely correct, you get nowhere with a certificate without >> the matching private key. In fact, the PoP (Proof-of-Possession) schemes >> featured in enrollment schemes are redundant. Attestations of the kind >> there are in ETSI/3GPP and TCG protocols OTOH, actually fills a purpose >> since they identify the key-container. > > Ah you mean the crypto key, or the telephone keychain? The origin of this is the telecom and banking communities who want to be assured that keys reside in a container of their liking (SIM, "Carte Bleu" etc). > I suppose that is nice if you want to tie someone to a device, It is actually more than nice because it eliminates enrollment passwords. 1. Sign up. create a request 2. An issuer asks you about the device ID 3. After verification the request can be approved > but problematic if you want more self asserted identity for privacy reasons. > It could be that there is space for both schemes. Yes, indeed. I recently added PEP (Privacy Enhanced Provisioning) as an option in SKS/KeyGen2 to please both "camps" :-) >>> By the way I don't see how what Apple is doing could have a better user interface. >>> The user interface for keygen is: click a button. Unless they move to mind reading... >> >> Well, user-interface is just one aspect but if we concentrate on that one, Apple's >> solution eliminates the confusing strong/weak button. > > Agree, the strong/weak button should just be a hint. Mind you it could be thought of that > way. Opera gives way too many options there, Other browsers give much fewer. So it would > not be impossible to have a browser just give none. Work to eliminate that button to > everyone's satisfaction would certainly be welcome. That would be a better thing than the MD5 enhancement. A slight problem is that Microsoft doesn't accept <keygen>. Anders > >> >> Anders >> >>> >>> Henry >>> >>> >>>> >>>> Anders >>>> >>> >>> Social Web Architect >>> http://bblfish.net/ >>> >>> >>> >> > > Social Web Architect > http://bblfish.net/ > > >
Received on Saturday, 6 August 2011 10:35:58 UTC