Fw: SV: Article of Le Monde.fr / Hans Nilsson

FYI

 

Jeremy

 

----- Original Message ----- 

From: Edward Hardam 

To:  

Sent: Saturday, May 31, 2003 3:10 PM

Subject: Re: SV: Article of Le Monde.fr / Hans Nilsson

On behalf of the Dutch government PKI taskforce I am right now 
looking 
into the interoperability (or better mobility) issues related to the 
use 
of different smartcards on diferent card accepting points (reader + 

drivers + middleware). If this issues can not be resolved, we are not 

going to be able to roll out any kind of generic purpose smartcard be it 

a PKI card or other, We can not live with a single-type/vendor-for-all 

situation.

We know of a (=ONE) vendor of middleware that supports 
multiple cards on 
multiple platforms.  This may be ok for the nearest 
future, but we need 
more than that if we want to survive the comming 
years.  

We are looking into Finread as well as Area K deliverables. 
But what is 
the real support of these standards? Do they really resolove 
(some of) 
the issues?

If some of us is also facing this challenge (in 
a practical way),  maybe 
we should discuss our problems and findings 
somehow. Maybe a meeting?

If you are dealing with this issue now, 
especially from a user 
perspective, feel free to contact me personally or 
via this list.

Edward Hardam

 
heeft geschreven:

>The article http://www.lemonde.fr/imprimer_article_ref/0,5987,3244--321098,00.html
>should 
concern us all, as it (among other issues) adresses the growing awareness of 
compatibility problems for executing PKI-elements such as the support and 
combinations of:
>- SmartCard vs.
>- Smart Card Reader vs.  

>- OS (Windows / MAC / Unix / Linux /etc etc) vs.
>- Browser 
(Netscape / Explorer / Opera etc & variations between the 
versions)
>
>A page showing an incomplete but scaring matrix 
revealing some combination issues is presented by 
FinEid:
>http://www.fineid.fi/default.asp?path=4%2CTechnical+information%2F4%2CSmart+card+readers&template=
>
>
>Another 
issue concerning SmartCard solutions and SCCP EAL4+ requirements:
>Will a 
smartcard solution satisfy the CWA EAL4/EAL4+ requirements if the smartcard 
reader is of the normal cheap type (i.e without dedicated key pad / display 
etc.)where parts of the signature information (PIN-code, document display etc.) 
must be routed over OS'es (WIN2000 / NT etc,)which decline to support higher CC 
evaluation levels than EAL3 ? (Check any CC Evaluated Product 
List)
>
>Regards
>Tor Hjalmar Johannessen
>Telenor 
R&D
>Norway
>
>-------------------------------------------------------------------------------------------
>A 
BabelFish (incomplete of course) translation of the LeMonde article is enclosed 
below:
>
>Why the electronic signature remains dead letter the WORLD 
| 22.05.03 | 13h57? UPDATED the 22.05.03 | 13h58 
>
>Three years 
after the law which conferred the same force as with the handwritten signature 
to him, the electronic paraph and the functions of coding which are associated 
for him are long in spreading. The complexity of the organization necessary to 
its installation rejects the industrialists. Deserted spans, cancelled 
conferences, d廥?uvr廥 exhibitors... The environment of the Show Infosec 2003, 
specialized in the computer security, which has been just held from the 20 to 
May 22 at the CNIT in Paris, slices with the effervescence of the last years. 
Three years after the adoption of the law on the electronic signature, this one 
is long in entering the m?urs. Admittedly, the industrialists must have patience 
so that the decrees of application (2001) and the ministerial decrees (2002) 
specify the technical and legal conditions giving to the electronic signature 
the same convincing value as with the handwritten signature. Admittedly, "bubble 
Internet" burst in the interval, tarin!
g!
> the financings. For as 
much, one is badly explained the lack of enthusiasm with respect to a technology 
- the infrastructure with public keys (ICP) - which was presented at one time 
like the average ideal to establish confidence on Internet. It would allow, 
announced one, to control the identity of the Net surfers, to guarantee the 
confidentiality and the integrity of the messages forwarding on the network and 
to keep the proof that the exchange of documents had taken place well. In short, 
to use the open network to make circulate significant information, to place from 
the orders, to sign documents, all expensive things in time and silver in the 
real world. In the middle of the years 1990, most optimistic counted on a market 
generated by the ICP of 3,5 billion dollars in 2005. However, in 2002, it would 
not have exceeded 350 million dollars. BRITISH SECRET SERVICE In theory, the ICP 
are a tool without rival. They rest on the principle of coding known as 
asymmetrical, invente!
d!
> into 1973 within the British secret 
service, then rediscovered by
> Helmann, which in 1976 state the principle 
of it: to use a pair of keys, of which one is public and makes it possible all 
to sign or quantify a document, while the other is secret and makes it possible 
to its only owner to proceed to the opposite operation. In 1978, academics, 
Ronald Rivest, Adi Shamir and Leonard Adleman, proposed an algorithm allowing to 
carry out this prowess using prime numbers. Their system, baptized RSA, is with 
the c?ur solutions ICP suggested today, which rest on attribution with the users 
of indentity cards numerical, the certificates, standardized and recognized by 
the majority of the software of navigation or transport. It was enough to 
increase the length of the keys to put them at the shelter attacks of computers 
increasingly more powerful and able, from now on, to work in network on all 
planet. Technology is thus not in cause.C' is its setting in?uvre which poses 
problem. The regulation envisages a pyramid of actors. It includes/understands 
dis!
t!
>ributors of certificates (in France, primarily Certplus and 
Certinomis) approved by authorities of certifications (generally of the banks) 
which, themselves, are the subject of procedures of qualification. One needs 
also validateurs able to hold up to date the directories of certificates and to 
withdraw from them those which arrived to expiry or which were revoked. The 
end-user must finally be duly identified, which supposes sometimes a meeting 
physique."Le more complicated, it is to organize confidence and to maintain it 
twenty-four hours out of twenty-four ", underlines Richard Pirim, architect 
system safety and network of the general direction of the taxes, which could 
judge complexity of the problem at the time of the installation of 
t幨廧roc嶮ures for the payment of the VAT by the large companies and the 
declaration in line of income tax, to which 608 000 people proceeded in 2003. It 
is - with the chart of health - only uses of scale IPC in France. Still the 
ministry for!
 !
>finances it had to make compulsory the 
home-bankings of the VAT fo
>lion euros of sales turnover which is forced 
to buy electronic certificates, The electronic signature however remains 
confidential. Some start-up try to make it more convivial or attractive. It is 
the case, for example, of E-picture-Certification.com, which proposes, except 
ICP, a software making it possible to join an electronic signature with the 
image of a handwritten signature. The young company Cryptolog ambitionne, for 
its part, to make the economy of the deployment of key USB or card readers to 
chip, the usual supports of the certificates to replace them by virtual 
certificates stored on a distant waiter and protected by algorithms with null 
knowledge. Others, like Audiosmartcard, sell sound smart cards which avoid the 
recourse to expensive card readers, since they call upon the microphone of the 
ordinateurs.Reste to knowing if the market is ripe. The authorities have, on the 
matter, a major capacity of incentive. The project of indentity card to chip of 
the ministry f!
o!
>r the interior could be used as free certificate. 
Minefi considers several projects of t幨廧roc嶮ures calling upon the electronic 
signature. But it cannot be allowed to propose an application which would force 
the users in the choice of the material - certain software does not envisage the 
storage of the certificates, Mac do not manage the encryption algorithms and 
certain versions of Windows do not accept the Java applications. To find a 
solution universal thus concerns the challenge. "a complexity to make quiver the 
developers", notes Richard Pirim. Minefi plans to call upon the large schools to 
develop an application of signature which could be versed in the public domain. 
What has supposed new times... Herve Morin an indentity card to chip is with the 
彋udeLe ministry for the interior board, for several months, on a new generation 
of indentity card, equipped of a microchip. The working groups of the Beauvau 
Place did not rule yet officially on the type and the quantity 
of!
 !
>personal information which could be stored there. 
Biometric inform
>, in particular, the fingerprints.  Such a 
possibility could cause the emergence of new card readers to chip able to 
authenticate their carrier formally. And justice the Ministers of Interior 
Department of G8, which met in Paris, Monday May 5, committed themselves besides 
resorting to biometrics like method of identification of their citizens. The 
United States already fixed, indeed, at October 2004 the date from which 
controls resorting to the biometrics of the identity and transport documents 
will be necessary for the entry on the American territory. 
>
> 

>
>  
>