<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.21023" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2><FONT face=Arial size=2>I don't know how far you
have gotten with <keygen>.</FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT face=Arial size=2>You <EM>may</EM> be
interested in knowing what the "competition" is doing :-)</FONT></DIV>
<DIV>
<DIV> </DIV>
<DIV>F<FONT face=Arial size=2>rom a provisioning point of view smart cards have
a long way to go. From the SKS paper:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> "</FONT><FONT face=Arial
size=2><FONT face=Arial size=2>even if you buy a $100 card; it still doesn’t
enable an </FONT></FONT><I><FONT face=Arial size=2><FONT face=Arial
size=2>on-line issuer </FONT></FONT></I></DIV>
<DIV><FONT face=Arial size=2><FONT face=Arial
size=2> </FONT></FONT><FONT face=Arial
size=2><FONT face=Arial size=2>to verify that keys were actually created in the
card!"</FONT></FONT></DIV>
<DIV> </DIV>
<DIV>Since on-line provisioning is the norm for Information Cards, mobile
device keys, etc, I have added something which I call "Air-tight Provisioning"
to the USB memory stick design I'm working with.</DIV>
<DIV> </DIV><FONT face=Arial size=2>
<DIV><FONT face=Arial size=2><FONT face=Arial size=2>Air-tight provisioning, the
basics:</DIV>
<DIV></FONT></FONT><A
href="http://webpki.org/papers/keygen2/secure-key-store.pdf">http://webpki.org/papers/keygen2/secure-key-store.pdf</A></DIV>
<DIV>If you take a look at "Dual-use Device IDs", you will find a novel
(?) use of device certificates.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV><FONT face=Arial size=2>
<DIV><FONT face=Arial size=2><FONT face=Arial size=2>Air-tight provisioning,
core facility:</DIV>
<DIV></FONT></FONT><A
href="http://webpki.org/papers/keygen2/session-key-establishment--security-element-2-server.pdf">http://webpki.org/papers/keygen2/session-key-establishment--security-element-2-server.pdf</A></DIV>
<DIV> </DIV>
<DIV>The most important conclusion drawn so far is that provisioning must be an
<EM>integral</EM> part of a cryptographic sub-system, otherwise it will be full
with quirks, security holes, and interoperability issues. A good
thing is that nothing prevents designs like the above to be used with
conventional cryptographic APIs for the "execution" part of a key's life; it is
"only" the provisioning and management operations that need a major
overhaul.</DIV>
<DIV> </DIV>
<DIV>Is this standardization? Not really. After talking to
literally hundreds of people, it is fairly clear that standardization takes too
long time, is riddled by politics, and very often lacks real-world
testing. XKMS is an example of a standard that failed on the market in
spite of being supported by all he big guns. Open design, free code, and a
community seems to be the most realistic way ahead.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Anders Rundgren</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV></FONT></DIV></BODY></HTML>