[KEYPROV] Open Software is NOT the answer

[Anders Rundgren <[e-mail]>]

Or to be more correct.  Open Source is quite important for establishing new
technology but it is not enough for establishing something "KEYPROV-ish".

Why is that?  Because a provisioning protocol to be useful must be
connected to a container and here we have a bunch of problems,
particularly with respect to hardware devices.  My own work in this
space has been considerably crippled by the requirements of signed
NDAs for just getting a data-sheet for suitable security hardware.

If you publish software that operates with such a device, you are actually
violating the NDA!

The solution as I see it is developing new stuff using standard electronics
and publish that as Open Security Hardware.  For true smart card
connoisseurs this probably sounds like a pretty bad idea.

However, it might very well prove to be the opposite because it allows you
creating a market for "de-luxe" tokens meeting stringent certifications, as
well as for low-cost dittos that you can buy at "Wal-Mart",  while still
powered by the same protocols and middleware.  It is all about reaching
the critical mass of adoption, isn't it?

The vendors (of course) do not have to publish anything, they would use
the Open Security Hardware as a reference; they may even contribute to
that part with additional tests since this part is quite important, but also
boring and time-consuming.

Another advantage with using standard electronics is that you can get
away from the Wassenaar agreement because the low-cost version can
be manufactured everywhere, including by countries that do not respect
international crypto export laws.  The latter are quite dubious anyway:
nowadays terrorists are legal residents and can buy (or download)
whatever they want.

Anders