0

The plan is to have a situation in which no third parties have to be trusted unless you explicitly indicate so. For example CA's are only used when the contact explicitly added the CA as a trusted party (there will be no such thing as root CA's or trusted CA's signing other CA's).

Methods I collected so far:

  • The above CA example.
  • Using a web-of-trust.
  • Sending a one time password to an un-authenticated public key, requiring this password to be sent back to you through another medium to prove it's you. Such as an SMS from a number that was known in advance or face-to-face. Since only the private key holder would be able to know this password it proves they own it.

Are there any other ways to authenticate certificate owners when you are not bound by standards but cannot distribute hardware in advance?

To clarify: It's about verifying the private key holder is really the person you believe should be the holder. So in other words it's about authenticating the identity of the owner of the certificate. So like: "Hey [email protected]! Are you really the Frank I know from class?"

Improve this question

1 Answer 1

Reset to default
1

Please define what exactly you want to authenticate about the party you are communicating with. Do you want to authenticate the name on their driver's license? That they have a valid credit card number you can charge? That they control a particular domain name? That they are your customer and control account number such-and-such? Something else?

For many web sites, all they need to know is that you are the same individual who created the account initially. When you log into your Gmail email account, all you need to do is to prove that you are the same person who initially created that account.

For many e-commerce web sites, all they need to know is that you have a valid credit card number and will pay up. For instance, when you log into your Amazon account and buy something, all that they need to know is that you are the same person who initially created that account and that your credit card number is valid and the charges on that credit card will be accepted.

Neither of these scenarios require certificates (they can be accomplished with certificates, but they can be accomplished in other ways as well).

In short, authentication is a broad subject. The way we authenticate another party depends upon what, exactly, we want to authenticate about them and what guarantees we want the authentication method to provide.

Improve this answer
5
  • I did state it in my question: "to authenticate certificate owners". I've added extra clarification to the question. On a side-note it's not intended for a website, but that's outside of the scope of the question.
    – Beanow
    Apr 22, 2012 at 14:37
  • @Beanow, thanks for your clarification, but I still find your goals ambiguous. You mention "authenticating the identity of the owner of the certificate". Well, identity is an amorphous concept; e.g., knowing that "Frank Smith" is the name on the person's driver's license is very different from knowing that "this is the Frank Smith I knew from high school" (for instance), and the way you'd go about verifying those two facts is very different. So there is no one answer to your question, at least until you pin down more precisely what you mean by authenticating.
    – D.W.
    Apr 22, 2012 at 22:54
  • No I'm quite sure about what I mean it just seems I haven't gotten it across. The user wishes to contact a specific physical human being. If you have found a potential address + certificate for the physical person you have in mind, how do you verify that it is actually them?
    – Beanow
    Apr 23, 2012 at 12:45
  • "The user wishes to contact a specific physical human being." - Right, but how does the user identify that human being in their mind? There are many ways that we identify who we want to talk to, and each one may well require its own verification procedure. It might be "my co-worker Lenny" or "the Frank I took classes with and got busted with when we tried to TP our neighbor's house" or "whoever is the head of the Accounting department" or "the person who can answer postal mail to J. Smith, 1234 Anywhere Drive, Nowheresville, NY 10012" or many other possibilities. Identity is tricky.
    – D.W.
    Apr 23, 2012 at 16:30
  • There you go now you've arrived at my question. It's a person you already know and you'll get a list of options to identify them. Such as sending a OTP from a mutually known phonenr. "The Frank I know from X and who's phonenr is: Y."
    – Beanow
    Apr 23, 2012 at 17:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .