Re: [TLS] EU cards

Anders Rundgren <anders.rundgren@telia.com> Fri, 29 July 2011 05:07 UTC

Return-Path: <anders.rundgren@telia.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B53A11E807F for <tls@ietfa.amsl.com>; Thu, 28 Jul 2011 22:07:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.269
X-Spam-Level:
X-Spam-Status: No, score=-3.269 tagged_above=-999 required=5 tests=[AWL=-0.270, BAYES_00=-2.599, J_CHICKENPOX_15=0.6, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cNV26TjjGS7o for <tls@ietfa.amsl.com>; Thu, 28 Jul 2011 22:07:56 -0700 (PDT)
Received: from smtp-out12.han.skanova.net (smtp-out12.han.skanova.net [195.67.226.212]) by ietfa.amsl.com (Postfix) with ESMTP id 0582D11E8075 for <tls@ietf.org>; Thu, 28 Jul 2011 22:07:52 -0700 (PDT)
Received: from [192.168.0.202] (81.232.44.37) by smtp-out12.han.skanova.net (8.5.133) (authenticated as u36408181) id 4DF89E7F0082AA94; Fri, 29 Jul 2011 07:07:49 +0200
Message-ID: <4E324016.90903@telia.com>
Date: Fri, 29 Jul 2011 07:07:34 +0200
From: Anders Rundgren <anders.rundgren@telia.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.18) Gecko/20110616 Thunderbird/3.1.11
MIME-Version: 1.0
To: "Blumenthal, Uri - 0668 - MITLL" <uri@ll.mit.edu>
References: <20110728194221.3655211E8134@ietfa.amsl.com>
In-Reply-To: <20110728194221.3655211E8134@ietfa.amsl.com>
X-Enigmail-Version: 1.1.1
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Cc: "'tls@ietf.org'" <tls@ietf.org>
Subject: Re: [TLS] EU cards
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 29 Jul 2011 05:07:57 -0000

On 2011-07-28 21:42, Blumenthal, Uri - 0668 - MITLL wrote:
> Anders,
> 
> Where is your data on government cards usage coming from?

various mailing lists such as:
http://www.opensc-project.org/opensc

Most of the people hanging out there are in some way working with the EU cards.

> 
> In US a lot (literally millions) of government email and Web access 
> is secured by what you call "government cards".

I guess you refer to PIV and CAC?
There is a fundamental difference between the US and the EU and that
only in the EU there is something called "citizen-cards" or eID.

Citizens are supposed to buy eID for carrying out secure services on
the Internet.  The cost have been high; results have been marginal
for the reasons I listed (and some more...).

Obama's NSTIC is something similar (but still very different) that
will be slightly interesting following although I don't think
their NIST friends really understand the consumer market and
the huge technical issues they will have to deal with.

IMO, the PC platform is dead as a vehicle for innovation; they
might go to phones from the start.  I never understood why
you need a picture on a token for Internet access :-)

Well, "it has always been like that" is probably the [lame] excuse.

Regards,
Anders

> 
> --
> Regards,
> Uri
> 
> ----- Original Message -----
> From: Anders Rundgren [mailto:anders.rundgren@telia.com]
> Sent: Thursday, July 28, 2011 03:10 PM
> To: Henry Story <henry.story@bblfish.net>
> Cc: S.tefan Winter <stefan.winter@restena.lu>; Martin Gaedke <martin.gaedke@informatik.tu-chemnitz.de>; tls@ietf.org <tls@ietf.org>
> Subject: Re: [TLS] EU cards
> 
> Dropping HTTPS CCA, it will never leave the 0.1% slot anyway so
> why would the browser vendor bother about how it works?
> 
> Now to the cards: Since
> 1. readers is a non-standard item
> 2. all cards need different middleware
> 3. cannot be fitted with additional certificates
> 4. is generally only trusted by a restricted group
> 5. commercial CAs require certified RP SW, contracts
> this is simply put entirely uninteresting
> 
> The government cards are status projects.  We have issued
> x millions cards.  That they are only used as physical ID-cards
> is something they are slightly less open about...
> 
> Banks in Scandinavia put eID on credit-cards which means that
> every merchant get your SSN as well (if they want).
> 
> As I say all the time: Google and Apple will make all EU cards look
> like they always was: A pile of s--t.
> 
> Anders
> 
> On 2011-07-28 17:07, Henry Story wrote:
>> Hi Peter,
>>
>>  You may want to ask Prof. Martin Gaedke about this. He is working his way through the 
>> EU area on this and should have some good pointers on where these token cards are 
>> going around here. 
>>
>>    Henry
>>
>> On 28 Jul 2011, at 16:45, Peter Gutmann wrote:
>>
>>> Stefan Winter <stefan.winter@restena.lu> writes:
>>>
>>>> Banking: These days, TAN lists are going away.
>>>
>>> Is there any information on what's being done in countries like France, Italy,
>>> the Netherlands, Spain, ...?  The only place where it's really documented (in
>>> quite some detail) is Germany (with surrounding/similar countries like Austria
>>> and Switzerland using equivalent approaches), but what are other countries in
>>> Europe doing?  There's rather little information *from third parties, not the
>>> vendors* publicly available on how e-banking is done in France, Spain, ...,
>>> the pros and cons, how it deals with new attack types, and so on.
>>>
>>>> a) cell phone transaction numbers:
>>>
>>> The problem is that mTANs are vulnerable to smartphone malware, as Zeus has
>>> already shown.  It's currently a minor threat, but who knows how far the bad
>>> guys will take it.  On the whole though mTANs are a nice tradeoff, you get to
>>> verify the transaction over an independent channel, and the mTAN is a
>>> cryptographic hash over the transaction data so if a MITB tries to modify what
>>> the browser sends it gets detected.
>>>
>>> Peter.
>>> _______________________________________________
>>> TLS mailing list
>>> TLS@ietf.org
>>> https://www.ietf.org/mailman/listinfo/tls
>>
>> Social Web Architect
>> http://bblfish.net/
>>
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
>>
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>