Subject: Re: Permanent identifiers in QC

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 10 Apr 2000 21:04:05 +0100

David,

>Perhaps Steve meant access control in a broader sense than you mean it.

Could be.

>When a human views an authenticated identity, it might be solely for
>the purpose of being able to say "yeah, that's nice".  And a machine
>might capture an authenticated identity solely for tracking or audit
>purposes.

That is indeed a possible scenario but I does not appear to be main-stream.

>But for the applications you mention, there is a decision made on the
>basis of the authenticated identity: the bank grants access to a
>particular account, the authority grants access to a particular
>citizen's records.  Do you have in mind any scenario where an identity
>is authenticated but not used to mediate access to a resource?

Not really, in most cases a digital signature is supposed to initiate something
which in the end has to do with access to resources so access control in a wider
perspective in in my opionion not a marginal application, but THE application.
At least seen from a commercial point of view.

Anders

>Dave
>
>
>
>> From: "Anders Rundgren" <[email-masked]>
>> To: <[email-masked]>, "Stephen Kent" <[email-masked]>
>> Subject: Re: Permanent identifiers in QC
>> Date: Sun, 9 Apr 2000 17:32:07 +0100
>> 
>> >Looking over this thread, and recalling Denis's presentation in Adelaide, I 
>agree with Stefan that IF we were to adopt a permanent >ID name type in PKIX, 
>the motivations cited by Denis for his proposal are access control based and 
>thus NOT suitable for inclusion >in the QC document. Also, since there is still 
>disagreement over other motivations for such identifiers, and their form in QCs, 
>I think >it unwise to incluide them in the QC document at this late date. Thus I 
>believe that we are ready to proceed with the QC document.
>> 
>> Steve, you are right that it may be best to proceed with the QC document, but 
>you are definitely wrong when you
>> say that permanent IDs only apply to access control.  They apply to ANY 
>situation where the identity of the signer,
>> authenticator etc has to be verified on-line.  From Internet-banking to 
>authority-to-citizen communication.  At least if
>> TTPs are used as CAs for client certficates.
>> 
>> <snip>
>> 
>> Anders
>> 
>> 
>> 
>> 
>> 
>*******************************************************************************
>> This confirms that this email message has been swept by
>> MIMEsweeper for the presence of computer viruses.
>> 
>*******************************************************************************

---

From: Stephen Kent <[email-masked]>
Date: Mon, 10 Apr 2000 19:06:29 -0400

Anders & Dave,

The scenario Dave provided is an access control example.  It is 
broader than what Denis suggested in his presentation, and thus is 
not what I was referring to, but it is still valid.

The emphasis on signatures verified using QC certificates has been on 
their use in non-repudiable transactions.  In such cases, access 
control may or may not be an issue.

Steve