4

You may have heard of the european eIDAS and the approaches of the individual countries to electronical citizen authentication (eg Belgium, Estonia, Germany, Austria).

Now there's only a single CA (German page) that I'm aware of that uses at least the German system and this CA forms a closed ecosystem ie it's not default-trusted.

So my question:
Why don't CAs pick up these systems for authentication, after all it can save them the man-hours required for verification of scanned documents and gives a higher degree of confidence than these scans?

And please don't answer: "It's not covered by the CA/B Baseline requirements currently."

4
  • this is opinion more than technology
    – schroeder
    Jun 9, 2017 at 6:57
  • 2
    @schroeder actually I think the issue is part technology, part regulations, part something like "not worth it" and part "why bother" and part "it's less profitable". While I see what you mean (probably related to the last three reasons) I think we can still find objective reasons for the lack of adoption.
    – SEJPM
    Jun 9, 2017 at 7:02
  • Sure, but won't the objective reasons be business concerns and not security concerns, as you suggest? Your question, as asked, literally is: "why don't they do this voluntarily?"
    – schroeder
    Jun 9, 2017 at 8:02
  • I hope that this whole CA chaos will get obsolet one day by the blockchain... The whole structure has way to much administrative expenses.
    – licklake
    Jun 12, 2017 at 12:03

3 Answers 3

4
+50

Because the eIDAS is not sufficient to comply with the requirements that the CA are trusted to validate, for the purpose of browser's TLS communication. It is important to understand that the job of a CA is to verify a set of assertions against a CPS (Certification Practice Statement). A CA can declare pretty much anything in their CPS, but it's ultimately the relying party that will verify whether a CPS is suitable for their use. For the purpose of HTTPS certificate, the relying party is the browser manufacturers, and browser manufacturers would only include CA products whose CPS are suitable for HTTPS communication.

The CA/B guideline specifies validation requirements for x509 certificates issued for the purpose of HTTPS communication. For HTTPS communication, the most central validation requirement is the domain control validation, which electronic ID does not help with at all.

In the level of OV, the CA are also required to verify the business/organization named in the certificate against a government business registry (or against some other qualified independent information source), electronic identity card only proves the identity of an individual, not an organization, so it doesn't help here either.

At the level of EV, the CA is also required to verify that the primary contact of the organization is authorized to act on behalf of the business to purchase the certificate. One of the step in EV requires verification of the identity of the representative, here electronic identity certainly helps with the verification of the representative's identity, but it doesn't help with verifying that the named representative are authorized by the organization. At EV level, there are so many other validation requirements that verification of the representative's identity is just one small point among many, such that the impact of the availability of electronic identity is fairly minor in the grand scheme of things.

Does this mean that the eIDAS is useless? Not quite. From what I understand, eIDAS provides a legal framework that asserts that digital signatures including signatures from x509 will be at least as legally binding as ink based signature. A law like that can provide legal framework that makes email and client certificates more broadly useful.

0

I can only answer this from a german perspective:

This article outlines three main concerns with the german solution:

  1. the software used isn't open source
  2. the ToS states that only private use is free of charge
  3. the software collects data of the licensee and sends it to the developers for further processing

To answer your question with a bit of opinion: One party that was involved in the development of this CA is known for a constant line of failure over the last 20 years inside the IT-community in Germany and is therefore neither well liked nor trusted. (That would be the Deutsche Telekom)

0

Two points come to mind:

  1. Risk of the less-understood: The CPS (Certificate Practice Statement) of a CA is written not only to clarify their processes / procedures, but also to minimize and keep deterministic, their liabilities. Due to this, the CPS is often written by Risk Management professionals or at the very least, reviewed and revised by them. This usually means priorities fight for balance. The risk of trust mechanisms failing in a completely electronic verification system often puts these at a disadvantage.
  2. Cost: Connecting to, and retrieving personal information from an eIDAS system can be expensive. Privacy regulations, especially in Europe would mean high impact risks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .