3

In countries like Germany each citizen has an identity card that is issued by the registration authority.

Since the identity of a citizen is, in a sense, created by that authority via assigning him a unique number, why not let it also to directly certify the public key of any citizen who desires to employ asymmetric encryption?

I mean the person would on that occasion have his identity be once again checked by the authority (presumably much better, e.g. concerning the current validity of the identity card, certainly not worse than, any common CAs) and then have his public key be entered (for a moderate charge) into a list of public keys that is freely accessible to the public at computer terminals of all offices of the registration authority. This way, the difficult issue of trust on the common CAs (or their equivalents) could be in the practically best feasible manner avoided IMHO.

5
  • 2
    Funfact: You can indeed get a valid certificate for your ID card in Germany for 10€ / year. This enables you to use your ID card as smart card and you can legally binding sign documents with this cert / key. – SEJPM Aug 22 '15 at 16:58
  • @SEJPM: Wiki says: "Das Erstellen von qualifizierten elektronischen Signaturen (QES) ist aber derzeit noch nicht möglich." Anyway, I don't yet see how one would (without a common CA) have his self-generated public key be certified by the German authority. Could you please say something more concrete? – Mok-Kong Shen Aug 23 '15 at 19:22
  • I was referring to the "sign-me" project (link in german), which was also mentioned in this article, AFAICT this should allow one to legally sign documents, although it looks like the cert isn't issued by the german authority. After looking at it now it indeed looks like this cert is "only" for qualified signatures. However D-Trust (run by Bundesdruckerei, owned by Germany) is a widely accepted CA. I think the way this works is by using the eID function to identify you and verify the binding of the key by some fancy functionality I don't know. – SEJPM Aug 23 '15 at 19:38
  • @SEJPM: Thanks for the informations. My issue is however to have a public key generated by a person (of length of his own choice) be certified by the authority, which IMHO could be most simply done, if the authority just enters that key into a publically accessible list maintained by it (without indirectly via a digital certificate from the authority, which would unnecessarily complicate the security issue in my view.) – Mok-Kong Shen Aug 24 '15 at 10:11
  • You can also use your ID card to get an e-signature in Spain. – JonnyWizz Nov 8 '15 at 22:42
1

You are proposing that, instead of using a standard PKI, where someone (goverment or not) controls a CA that signs certificates, would be simpler to just have a (big) list of government recognized public keys associated with the related person. In other words, a big searchable list of certificate contents. You claim that this would avoid "the difficult issue of trust on the common CAs (or their equivalents)"

First of all, to be sure you are checking the right and trusted list, the search server would need to be authenticated somehow (to fully avoid PKI, that is used in TLS/SSL, probably you would have to put the certificate of the server in your trust it and check out-of-bounds if it is valid). It is not clear how would you solve this in an scalable manner without using PKI. It is possible, of course, but not easier or simplier than the standard PKI trust challanges.

BTW, part of my master thesis work is about how a PKI could be to solve some of the problems of standard PKI, and we use online servers to provide certificate status and discuss many problems with standard PKIs. In many ways your proposal fits with ours, except it is not targeted on solving the trust issues of PKI, but other problems. Part of the work is available here: https://www.cdc.informatik.tu-darmstadt.de/reports/reports/TheNotaryBasedPKI.pdf

While NOT solving the trust issue, your proposal adds many other problems:

1) It is not offline verifiable. One may claim that this is not a problem nowadays, when everything is always online, and while not strictly true, I agree that for most applications there is no big advantage at the offline characteristics of x509 PKI (thats why we proposed NBPKI too)

2) For signature/verification, you need to be able to verify at any time in the future if a key binding was valid when the signature was done. For some scenarios that can take years and decades between the signature and the last needed verification. That means that even if the binding between person x key is lost, the server still needs to at any time in the future be able to give the key that was valid in a certain time in the past. So, the list only grows; That is not good because it wont scale whell, will not be efficient;

3) You have a single trust point to be attacked. Not good at all;

4) To solve all this problems is exaclty why PKI is how it is. Instead of a list, you have proofs of link between each key and each person. Those are small, and actually EASIER to validate (cost less computational power and resources). Those proofs have a presumed valididty usually based on how protected the private key is, and can be revoked if needed using a list of revoked certificates (that tends to be smaller than a list of valid ones, and can be made smaller using OCSP).

You mention the problem that is hard to trust in the common CAs. That is not strictly true, and can be solved by some means: Federated CAs, or TSL (Trusted Services List, used on Europe) or just have a national root CA as is done in Brazil that signs all other trusted CAs, so you need only to trust a single trust point. If thats the main reason to choose your proposal, I don´t see a real advantage between having a single national CA and your proposal. Other than that, PKI has so many advantages over your proposal on real usage scenarios, that explain why it is widelly used until now.

Having that said, PKI have its own problems, but most of them are exactly on the centralization of trust in FEW points, and may be solved by more decentralized approaches. Your porposal is going in the oposite direction, by proposing centralizing even more the trust in a single list.

19
  • I don't yet understand your 2nd paragraph. If a citizen needs the service of the authority that manages the public keys to supply him the public key of one single person (or of a few persons), why is the proper way of getting the required highly limited informations uniquely via obtainíng the entire database of the authority? (Analogy: One asks the service of a telephone company to provide the telephone number of a certain person,) – Mok-Kong Shen Jan 7 '16 at 19:17
  • How would you check this information to be valid? How would you proof later that you checked it? How would you transport this verifiable proof to be verified later on? The best answer to all that is a certificate ;) There are many aspects of this that you are not considering. Signed data must be stored and transported. Needs to be stored to be verified later on. How would one verify in the future if a signature in the past was valid if the key registered for the person changes? That all is solved in standard PKIs. – CristianTM Jan 8 '16 at 0:21
  • However, let me add something. This paper (that is part of my master thesis) may be something a little bit close of what you are thinking on. In your case, the notary would be the government. Take a look and tell me what you think. The idea has its own open challenges, but also tries to solve some of the standard PKI problems (not the CA trust proplem, however) cdc.informatik.tu-darmstadt.de/reports/reports/… – CristianTM Jan 8 '16 at 0:28
  • Excuse me that for some unfortunate personal reasons I would have to delay studying your report. But let me add a point to my last comment: The security issue of obtaining from a site (government authority or trusted public institutions) informations is IMHO independent in principle from the sizes of the informations being transferred. If you consider you could download a huge list from a site securely (as you indicated to be a practical possibility), then it should be possible to similarly download a tiny part of the list. The actual tiny information could be requested at any time on need. – Mok-Kong Shen Jan 8 '16 at 11:09
  • Could be, but this information can change. When I sign I have one key. Than tomorrow you will verify but i lost my key and revoked it (removed from the list). The signature SHOULD be valid, but is not since I lost the key. Imagine a contract, that should be valid for years. For that, you need a proof that is verifiable. And a certificate is exactly such proof, that has the advantage of being verifiable "offline". In an online world, that could be changed, and that is what the paper is about, a proof that is obtained online. – CristianTM Jan 8 '16 at 11:39
0

Kong,

I'm not sure the question you've asked quite fits in here properly. If you're simply asking if it is possible that such a thing could be done the answer is yes. The US Government uses a Common Access Card (CAC) system for some federal employees and the cards are all included in a massive USG PKI infrastructure.

If you're meaning to ask why it's not already done there's no good way to answer that since it's speculation. If I were do guess it's due to cost and complexity along with demand. Today most people don't expect to have a PKI solution in their pocket provided by the government and there's definitely some people who would prefer not to.

Personally I would love to see such a system but I think it will be years still before something like that might come to life.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.