Subject: Re: Common misconceptions, was Re: KISS for PKIX. (Was: RE: ASN.1 vs XML (used to beRE: I-D ACTION :draft-ietf-pkix-scvp-00.txt))

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 17 Jul 1999 23:54:43 +0100

Todd,
<snip>
>> Regarding the binding I believe that certificates and CAs make sense if
>the CA
>> can guarantee (with high but not unlimited probability) that an individual
>cannot
>> "borrow" another's identity.  This is certainly feasible, partly by using
>biometrics.
>> And is not terribly expensive either.
>> To nail down an individual's true TRUE identity is NOT a requirement for
>employers, banks
>> etc. as long as you perform according to their rules.  If an RP needs
>stronger proofs of
>> identity this may have to be carried out without the CA.
>
>But Biometrics only addressses the Retail POS style model, becuase once the
>Biometric data is captured, it takes on the same vulnerability as the reast
>of the sata used as the auth enablement.

Hum, I don't really think we are talking about the same thing.  Biometrics in this
context is a tool for a CA to bind a physical person (body) to a certificate.  Could
use fingerprint or DNA fingerprints.  IMO physical person (body) is stronger than
identity as the latter can be forged much easier and is sometimes impossible
to verify (no papers available).

Anders

---

From: "Todd S. Glassey" <[email-masked]>
Date: Sun, 18 Jul 1999 10:44:55 -0700

Anders

> Hum, I don't really think we are talking about the same thing.

Actually we are, and I think thats the problem.

>Biometrics in this

Yes this is true, but what does it have to do with the original question?
that's not the context of this effort. The intent is to create better
systems to prove the conveyance on "human intent" into a digital context.
And since the systems themselves have no cogniscent existence under any law
on this planet, we have a minor goochie to deal with here.

In closing, I think that Biometrics like any other ancillary or secondary
auth model are usually only good for proof for the question: "was the person
who this act is done by actually the participant in the act"? It does
nothing to deal with conveyance in the third person or provide the ability
to have an act somewhere down the line be proven to be one of the one's that
this particular person intended to have happen and that they happened when
and how they were supposed to.

Todd