Subject: Re: Fw: PKI "not working"

From: [email-masked]
Date: Thu, 12 Jun 2003 12:07:44 -0600

something similar in threads on https (and other online) failings from the
cryptography mailing list
http://www.garlic.com/~lynn/aadsm14.htm#41 certificates and an alternative
view

http://www.garlic.com/~lynn/aadsm14.htm#5 Who's afraid of Mallory Wolf?
http://www.garlic.com/~lynn/aadsm14.htm#9 "Marginot Web" (SSL, payments,
etc)
http://www.garlic.com/~lynn/aadsm14.htm#30 Maybe It's Snake Oil All the Way
Down
http://www.garlic.com/~lynn/aadsm14.htm#32 An attack on paypal
http://www.garlic.com/~lynn/aadsm14.htm#33 An attack on paypal
http://www.garlic.com/~lynn/aadsm14.htm#34 virus attack on banks (was
attack on paypal)
http://www.garlic.com/~lynn/aadsm14.htm#35 The real problem that https has
conspicuously failed to fix
http://www.garlic.com/~lynn/aadsm14.htm#36 An attack on paypal
http://www.garlic.com/~lynn/aadsm14.htm#38 An attack on paypal (trivia
addenda)
http://www.garlic.com/~lynn/aadsm14.htm#39 An attack on paypal
http://www.garlic.com/~lynn/aadsm14.htm#40 The real problem that https has
conspicuously failed to fix
http://www.garlic.com/~lynn/aadsm14.htm#42 An attack on paypal

todd glossary <[email-masked] on 6/12/2003 8:28 am wrote:

This is a cross posting from the ISC's mailing lists of the Bar
Association.

Why it is important here is that it documents perceived problems in
the PKI marketplace and I perceive that a number of these issues are
failures in the IETF's and potentially the ETSI standards processes,
since they allow processes that are at best incomplete from a
deployment stance to be elevated into standards status IMHO.

My concern is that the value of the IETF and ETSI is growing less and
less with these types of realizations in the marketplace.

Todd

To: <[email-masked]>
Sent: Thursday, June 12, 2003 7:00 AM
Subject: UK: PKI "not working"

PKI is 'not working'

Inadequate technology for online transactions is a 'huge problem' for
those in charge of e-government, admits a leading Whitehall official
The e-envoy's office has started searching for new ways to
authenticate the users of e-services as the existing technology being
used is "not working", a senior Government official revealed on 11
June 2003. Although PKI (public key infrastructure) and digital
certificate technology has played a major role in leading projects
such as the Government Gateway, there is now growing recognition that
it is unsuited for wider public use. While digital certificates would
not be scrapped, and would be retained as an option for e-service
users, one possible alternative being suggested is that employers,
banks, the voluntary sector and other "trusted organisations" would
verify a person's identity before transacting online for
services. Speaking on condition of anonymity, the official said the
Government is now looking at "radical ways" of solving the
authentication problem. "Trust and authentication has been a huge
problem for us. We haven't got a solution for authentication. We've
been trying with PKI for about 10 years now and its not working
because it's a pain to implement and to use. We've been looking to
take the pain out of PKI. "What we are saying with authentication is
that if another trusted organisation such as a bank can provide proof
saying you are who you say you are that should take the need away for
digital certificates." The move comes as the e-envoy's office is
acutely aware that it needs to step up the pace of e-government
leading up to the 2005 target.

http://www.kablenet.com/kd.nsf/Frontpage/2FBC229CDE8C5A1680256D43004176EA?Op
enDocument

<http://www.kablenet.com/kd.nsf/Frontpage/2FBC229CDE8C5A1680256D43004176EA?O
penDocument>

Michael Power

Partner & Chief Privacy Officer
Gowling Lafleur Henderson LLP
Barristers & Solicitors
Patent & Trade Mark Agents
Suite 2600
160 Elgin Street
Ottawa, Ontario, CANADA
K1P 1C3

--
Internet trivia, 20th anv: http://www.garlic.com/~lynn/rfcietff.htm

---

From: [email-masked]
Date: Fri, 13 Jun 2003 09:43:03 +0000

"Not working" is a bit too broad. It is working in limited deployments but
in that the mechanism that makes it truly global (publicly accessible
directory) is missing it has yet to fulfil its potential.

I must admit I get as frustrated with the anti-hype as much as I do the
hype. I imagine both are put about by people who don't really understand
just how much has to be accomplished before it will all work as envisaged.

I will continue to be an optimist until someone gives me a darn good
reason as to why it cannot be done  :-)

Apologies for the top post

Chris

|--------+------------------------------->
|        |          "todd glassey"       |
|        |          <todd.glassey@worldne|
|        |          t.att.net>           |
|        |          Sent by:             |
|        |          owner-ietf-pkix@mail.|
|        |          imc.org              |
|        |                               |
|        |                               |
|        |          12/06/2003 14:28     |
|        |                               |
|--------+------------------------------->
  >-------------------------------------------------------------------------------|
  |                                                                               |
  |       To:     <[email-masked]>, "el-sign: electronic signatures - open     |
  |       discussion" <[email-masked]>                                     |
  |       cc:                                                                     |
  |       Subject:     Fw: PKI "not working"                                      |
  >-------------------------------------------------------------------------------|

This is a cross posting from the ISC's mailing lists of the Bar Association.

Why it is important here is that it documents perceived problems in the PKI
marketplace and I perceive that a number of these issues are failures in the
IETF's and potentially the ETSI standards processes, since they allow
processes that are at best incomplete from a deployment stance to be
elevated into standards status IMHO.

My concern is that the value of the IETF and ETSI is growing less and less
with these types of realizations in the marketplace.

Todd

> Inadequate technology for online transactions is a 'huge problem' for
those
> in charge of e-government, admits a leading Whitehall official The
e-envoy's
> office has started searching for new ways to authenticate the users of
> e-services as the existing technology being used is "not working", a
senior
> Government official revealed on 11 June 2003. Although PKI (public key
> infrastructure) and digital certificate technology has played a major role
> in leading projects such as the Government Gateway, there is now growing
> recognition that it is unsuited for wider public use. While digital
> certificates would not be scrapped, and would be retained as an option for
> e-service users, one possible alternative being suggested is that
employers,
> banks, the voluntary sector and other "trusted organisations" would verify
a
> person's identity before transacting online for services. Speaking on
> condition of anonymity, the official said the Government is now looking at
> "radical ways" of solving the authentication problem. "Trust and
> authentication has been a huge problem for us. We haven't got a solution
for
> authentication. We've been trying with PKI for about 10 years now and its
> not working because it's a pain to implement and to use. We've been
looking
> to take the pain out of PKI. "What we are saying with authentication is
that
> if another trusted organisation such as a bank can provide proof saying
you
> are who you say you are that should take the need away for digital
> certificates." The move comes as the e-envoy's office is acutely aware
that
> it needs to step up the pace of e-government leading up to the 2005
target.