[pkix] EST-02 and PIN-codes

Anders Rundgren <anders.rundgren@telia.com> Sat, 27 August 2011 06:48 UTC

Message-ID: <4E589383.7050309@telia.com>
Date: Sat, 27 Aug 2011 08:49:39 +0200
From: Anders Rundgren <anders.rundgren@telia.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.20) Gecko/20110804 Thunderbird/3.1.12
MIME-Version: 1.0
To: "pkix@ietf.org" <pkix@ietf.org>
Content-Type: multipart/alternative; boundary="------------050506070706060004020304"
Subject: [pkix] EST-02 and PIN-codes
Precedence: list

It has been mentioned in various list and off-list communication that associating an issuer-defined PIN-code to a deployed key in a token could be achieved by for example adding an attribute to the
certificate response.

However, this requires that the token runs in "Administrator Mode" which it does in traditional CMSes (Card Management Systems).

I maintain that performing token provisioning using a [future] standard browser in a /secure/, /scalable /and /user-friendly/ way is /_infeasible_/ based on current token technology since the latter
was neither designed to support end-user provisioning nor dealing with independent issuers.

In the SKS token, the administrator role is virtualized per issuer and doesn't require the middleware impersonating a token administrator.  The user's ability to change PINs etc is /unilaterally/
determined by each issuer's unique policy.  AFAICT, this assumes a full-blown E2ES (End To End Security) model.

The user's administrative capability is essentially limited to key delete operations and granting an issuer the right creating a key.

Anders

[pkix] EST-02 and PIN-codes Anders Rundgren