Subject: Re: Signing what you don't understand

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 20 Jul 2000 19:18:27 +0200

Peter,

>> Several leading PKI vendors have implemented systems where the private key
>> is held on a central Web server and then downloaded at run time to a web
>> browser.  Are you saying that signatures created using these keys are
>> invalid?
>Are you sure? Could you provide a reference? I doubt that strongly...
>
>Peter

I think this is one...

http://www.arcot.com/products/webfort.html

Anders

---

From: Richard Levitte <[email-masked]>
Date: Thu, 20 Jul 2000 20:23:51 +0200

> http://www.arcot.com/products/webfort.html

I think not, at least from reading the papers "Protecting Digital Identities" and
"Protecting Your Private Key".  All they say is that they've invented some kind
of key database ("key wallet" to use their term) that is more secure than what
comes with for example MSIE and Netscape Communicator...

Personally, if I was confronted with a CA that wanted to create my private key
for me, and store it centrally to boot, I'd go somewhere else.  Very fast.  It
contradicts anything even remotely close to being called "secure".

--
Richard Levitte   !!! New cell phone number !!!
[email-masked]

/* You might enjoy viewing the complete vCard */

---

From: Ronald A Martin <[email-masked]>
Date: Thu, 20 Jul 2000 16:20:19 -0400

Another...

 http://www.rsasecurity.com/products/keon/advancedpkiservices.html

    Ron

---

From: Stephen Kent <[email-masked]>
Date: Thu, 20 Jul 2000 17:33:22 -0400

Ron,

>  http://www.rsasecurity.com/products/keon/advancedpkiservices.html

I think what you cite here is one way to facilitate credential 
portability in the absence of hardware tokens. It might also be 
construed as a way to keep selling SecurID cards :-).  It does not 
fundamentally change the focus of our discussion; it is only an 
remote option for encrypted private key and cert storage.

Steve

---

From: Richard Levitte <[email-masked]>
Date: Fri, 21 Jul 2000 15:13:27 +0200

Oscar Jacobsson wrote:

> Richard Levitte wrote:
> This gets a bit problematic when you're dealing with a party that is
> literally authoritative, for instance the Swedish government, who will
> assign you a unique identifier whether you agree with their practises or
> not.

Thanks for kicking me back into reality...  :-)

---

From: Oscar Jacobsson <[email-masked]>
Date: Fri, 21 Jul 2000 14:49:55 +0200

I myself have, as an example, tried to inform the Swedish tax
authorities that I'd prefer to take my business elsewhere on a number of
occasions, since they tend to be a bit pricey for my taste. No luck yet
though. :-(

//oscar