TeleTrusT Initiatives for PKI Solutions PKI Forum meeting ‚PKI in Europe‘ Dublin, June 27st-29nd, 2000 TeleTrusT Initiatives for PKI Solutions Helmut Reimer TeleTrusT Deutschland e. V. E-Mail: teletrust@t-online.de http://www.teletrust.de

TeleTrusT: Association of Competence Promoting the trustworthiness of information and communication technology applied Cryptography & Biometrics founded in 1989 more than 95 members: major user sectors, research organisations, developers and manufacturers of security products, government agencies, and test institutes. non-profit, political independent

TeleTrusT: Working Groups / Projects Interoperability, Standards, Appropriate Security Legal aspects of the liability of communications (WG1) Security architecture / IC-Card security (WG2) Applications in health services (WG3) Open e-commerce security (WG4) Promotions (WG5) Biometrics identification (WG6) Public key infrastructure (WG7) MailTrusT (WG8) Chipcard-terminals (Project, MKT, UCTS) Project BioTrusT

Trustworthy IT Goals: - privacy / confidentiality - integrity - subscribers identification /authentication Conditions: - technology accepted publicly - security as a appropriate component of the business processes - the participant has an acting role - clearly recognisable risk spread

PKI & DS: Expected fields of application Private and business communications over the Internet (in connection with encryption). E-banking (i. e. home banking), e-business, e-commerce with better consumer protection. Public health services. Services of communes and authorities for the citizens. Many (but not all) applications require a legal recognition of the DS

PKI & DS-Regulations: The Pros and Cons/I Advantages The legal and evidence values of DS should be defined. The PKI is functional simple. By a national PKI- policy, the mutual recognition of certificates would be able to be supported The asymmetric crypto-graphy and their algo-rithms obtains acknow-ledgements by law. Providers of compo-nents and services and the customers have dependable conditions for investments.

PKI & DS-Regulations: The Pros and Cons/II Disadvantages The application of DS already requires a complete solution for the start. Business cases are not in view of the regulations. Quite difference views on CSP supervising or accreditation. The governmental-driven applications may be more or less closed shops

PKI, DS and E-Commerce Business to Business Business to Consumer Enterprise and/or Consumer to Authorities or public services Different security policies, different business conditions, different business cases Public key infrastructure: One for all?

CA Services: Business Case? /I E. g. Banking Organisations In house CA services: Cost / benefit relations can be calculated, security policy / business conditions / riscs / assurance conditions can be defined The costs for the customer can be formed marketably How can this concept support other applications?

CA Services: Business Case? /II E. g. CA Service Provider Return of investment? Costs by regulation (SigG: CA, Directory Services, Chipcard-Personalisation, Time Stamping ...) How does the integration of the services occur into the business concepts of the users? (E. g. Distribution of costs between different applications)

E-Commerce Security / I Security by regulation: Evaluation of technical components according to specific criteria (ITSEC, CC, FIPS 140....) Does so practical security result for an application? The same level of security - only a result of an unique security policy?

E-Commerce Security / II Security by business conditions: The practical security of application is the goal Evaluation of components and the business process according to application specific criteria Assurance and liability are components of the security policy Recognition of e. g. other certificates is part of business policy

TeleTrusT: Steps 2000 / I In general: The integration of PKI & DS into applications is much more difficult than expected TTT is included in the development of national specifications and standards: Interoperability at PKI-Level (SigI) Chipcards with DS functionality (DIN-Spec)

TeleTrusT: Steps 2000 / II Multifunctional Office Identity Chipcard Health Professional (Chip-) Card Evaluation of Chipcards ITSEC E4 high Generic PKI security policy Definition of application projects (e. g. Media@Komm) The results should be inserted into international standardization

TeleTrusT: Steps 2000 / III What do we need? Implementations of the DS in applications (reengineering of business processes) Security oriented Work Flow Systems / reliable archiving and more general Application and acceptance experiences

TeleTrusT Experiences 2000 MailTrusT - Sphinx: End-to-end-security with PKI for business communications E-Commerce / E-Business / E-Banking: Different protokolls are in use (e. g. SET, HBCI...) the certification infrastructure establishes itself with application specific certificates The interoperability and mutual recognition of certificates are current questions