<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">As a customer of Eddie's service I can say that it works quite well given the limitations of browsers.<div><br></div><div>Getting users to manage moving private keys and certificates from Firefox into an iPhone is not something most people are going to manage, given the current technology. (yes it is possible) </div><div><br></div><div>One possible area of exploration is coupling Eddie's existing LoA 2 certificates with openID Connect to have a LoA 2 service.</div><div><br></div><div>Doing that with openID 2.0 is still a LoA 1 service so not particularly interesting to NSTIC.</div><div><br></div><div>Having long experience with PKI client auth there are many things that could be done to improve the experience for using it as a primary authenticator for SAML, openID 2.0 and OpenID Connect.</div><div>It is probably best to separate the primary and secondary authenticator issues to some extent, especially if you are looking for a grant.</div><div><br></div><div>OpenID is agnostic to the primary authenticator technology used by Identity providers. Some like <a href="http://www.startssl.com/">StarSSL</a> use PKI, others like <a href="http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html">Google</a> are offering OTP, and SMS, and <a href="http://www.mobio.net/">Mobio</a> who are doing QR codes.</div><div><br></div><div>We still have a lot of room for innovation with primary authenticators. </div><div><br></div><div>The hardest work is perhaps the identity proofing and management at higher assurance levels, without that the value of the additional security is not apparent to a lot of people.</div><div><br></div><div>There are a lot of things people can try and get NSTIC grants for. </div><div><br></div><div>I don't know that the openID general list is necessarily the place to dig into the deployment details of PKI client auth though.</div><div><br></div><div>Good luck with your grant proposal for those of you going after it.</div><div><br></div><div>John B.</div><div><br></div><div><div><div>On 2012-02-14, at 7:55 AM, Eddy Nigg (StartCom Ltd.) wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<div bgcolor="#FFFFFF" text="#000000">
<br>
On 02/14/2012 06:46 AM, From Francisco Corella:
<blockquote cite="mid:1329194773.93431.YahooMailNeo@web125504.mail.ne1.yahoo.com" type="cite">
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255,
255); font-family: times new roman,new york,times,serif;
font-size: 12pt;">I guess you mean that if the relying party
downloads a certificate in<br>
the body of an HTTP response with a content-type header whose
value is<br>
a MIME type indicating that the body contains a certificate, and
if<br>
Firefox "finds a valid key pair" then Firefox will import the<br>
certificate automatically. Did I guess right?<br>
</div>
</blockquote>
<br>
Yes.<br>
<br>
<blockquote cite="mid:1329194773.93431.YahooMailNeo@web125504.mail.ne1.yahoo.com" type="cite">
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255,
255); font-family: times new roman,new york,times,serif;
font-size: 12pt;">Well, depending on the details, that could be
a security hole. If the<br>
valid key pair that Firefox finds consists of the publick key in
an<br>
existing certificate and the associated private key, Firefox
could end<br>
up replacing the existing certificate with one downloaded by an<br>
attacker that binds the public key to the attacker's identity.<br>
</div>
</blockquote>
<br>
No, if an attacker could do that it'd be too late anyway, then he
probably could impersonate the entire internet. "Finding" a public
key that would match a private key is kind of impossible (with
sufficient key size). But I'm not sure if this is the right forum
for such crypto stuff.<br>
<br>
<div class="moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, COO/CTO</td>
</tr>
<tr>
<td> </td>
<td><a href="http://www.startcom.org/">StartCom Ltd.</a></td>
</tr>
<tr>
<td>XMPP: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org/">Join the Revolution!</a></td>
</tr>
<tr>
<td>Twitter: </td>
<td><a href="http://twitter.com/eddy_nigg">Follow Me</a></td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</div>
_______________________________________________<br>general mailing list<br><a href="mailto:general@lists.openid.net">general@lists.openid.net</a><br>http://lists.openid.net/mailman/listinfo/openid-general<br></blockquote></div><br></div></body></html>