Subject: [KEYPROV] Provisioning Through Browsers - Status Report

From: Anders Rundgren <[email-masked]>
Date: Thu, 29 Apr 2010 12:08:27 +0200

I believe the "market" (whatever that is...) have given up the
hope that there ever will be "standards" for provisioning tokens
through browsers.  There are currently at least a handful more or
less private efforts for getting this on track.

Gemalto for example is betting on that APDU-based protocols is the future:

http://w2spconf.com/2009/papers/s4p4.pdf

I'm personally a bit cautious about exposing cryptographic APIs to
untrusted browser code.  If you for example compare this concept to
TLS-client-certificate authentication, the latter is indeed invoked
at the browser level but all the security operations are performed by
trusted platform code.

Here is an open source project exploring JDK 6's smart card I/O:

http://github.com/joelhockey/jspcsc

Other parties like GlobalPlatform are toiling with transforming cards
into web-servers to presumably bridge the gap between cards and the
IP-connected world.

The mobile phone industry once launched the GBA scheme but it didn't
got much traction since it is tied to SIM-cards.

I have (as you know too well by now...), come to the conclusion that
you rather need a trusted sub-system like Firefox's <keygen> but
"slightly" more advanced (1.5 passes versus 8/10), in addition
to new tokens that are designed for on-line from the beginning.

This will be like watching a sprinter-race between turtles:
When the winner finally passes the finishing-line, most people have
forgot what the race was all about :-)

Anders