|
A major problem with stuff like KEYPROV
and KeyGen2 as well as older schemes like <keygen>,
generateCRMFRequest() and CertEnroll is the absence of a suitable container and
compatible middleware for cryptographic keys.
It is true that governments, banks and a fraction
of private businesses can afford the hassle and cost
associated with regular smart cards but the fact is that they almost
without exception use physical token distribution making provisioning protocols
of pretty marginal interest.
I guess this is already a dead duck, but I don't
see why it is impossible to set aside 10M of flash in a (reprogrammed) but
HW-wise standard USB memory stick and use that for key storage and
execution.
Anders Rundgren
|