An Introduction to Information Card Barry Dorrans Charteris plc

Internet Authentication Patchwork of identity systems Criminalisation of the Internet Identity systems can be hard

Information Card is not Passport Published standard User controls what gets sent Anyone can issue information cards

The Laws of Identity User control and consent Minimal disclosure Justifiable parties Directed Identity

The Laws of Identity Pluralism of operators and technologies Human Integration Consistent Experience

What is “Information Card” Identity Provider Relying Party WSTrust, WSSecure, SAML

Types of Information Card Self Issued Managed

Self Issued Information Card Created by user “Phone book” information

Managed Information Card Issued by 3 rd Party Information held at source Can be protected further

Why “card”?

What is “CardSpace” Windows CardSpace is a piece of client software that enables users to provide their digital identity to online services in a simple, secure and trusted way.

What is “CardSpace” Identity Selector Client Software Vista, XP, Win2003 with.NET 3.0

CardSpace Security All communications are secured Information encrypted in memory Dual ACL protection

The typical login process Login to identity provider Token issued to client Token sent to service provider Token validated with identity provider Output sent to client

The Information Card process Service Provider Requests Identity CardSpace Identity Selector pops up Token is built by Identity Selector (with Identity Provider) Token sent to client Output sent to client

What about OpenID?

Identity Cards versus OpenID Identity CardOpenID Clientside promptHTML Form Common ExperienceExperience varies Simpler LoginRedirection / Site Bounce Requires SSLDoesn’t require SSL

What do I need to accept cards? SSL Certificate Object tag in HTML Processing Code server side (ASP.NET must have access to cert)

Why SSL? Used to identify relying party Tokens encrypted against it Revocation lists checked, hard to use self issued certs

Hello Information Card

SAML Assertion based. CardSpace is a SAML 2.0 “Enhanced Client Proxy”.

The WS-Trust Conversation Query MEX EndPoint Build Asymmetric Keys Talk

WS-Secure Token is encrypted using WS-Security.NET 3.0 provides classes to Un-encrypt Convert to SAML claims

Understanding a token Shows the token has been encrypted with AES256 CBC Symmetric Algorithm Both originator and recipient share the key

WS-Secure Key Protection Shows the symmetric key is being conveyed via RSA- OAEP-MGF1P The sender has made up a transient key (AES) Encrypted that key with the recipient SSL public key.

Where’s the token 77Ybo3C32JckPMD+lxm9t7KKxfQjMT8ojczrDs0i HsxJ3Q6i3B04RAGrOivLfqMYzYP4lZXsM2lF8cUs aVOTY9KqsJjpOBwyk37n9tw7pV6E3SXkHtXx92xl 5AqmjPeBdDI/syrIjgE1bpbn5sX5PpNoOmAbYSV2... Wvl2o5ABIqvToMV1bp16Ns1ImSgxuB074kmAvAUx b/LXPXq1Gwcz2YtyaHMYSUvzzzYRuDH9qu0R6748 B/C1if4MeXHUqMPYaEQ+dhuzoVUMuy7/kQVP5ckb B0asMSqIiJp5B4vecBe/aGQo9AYNEwPv4xAB5cvr PBEG4TCFtSVyJkn2LcdwNzqmNqIewGMxawwUPgxe D2w== That’s the SAML token

Token Headers

And finally … the claims Barry wL6Xi5Z5uXQnSu40mRbkpljc5uKvf02HyA SCo8uceNk=

Supported Claims Anonymous, Authentication, AuthorizationDecision, Country, DateOfBirth, Dns, , Gender, GivenName, Hash, HomePhone, Locality, MobilePhone, Name, NameIdentifier, OtherPhone, PostalCode, PPID, RSA, SID, SPN, StateOrProvince, StreetAddress, Surname, System, Thumbprint, Upn, URI, WebPage, X500DistinguishedName

Uniquely Identifying a card PPID for self issued cards Identity Provider Public Key & Unique claim for managed cards

Want to be an Identity Provider? EV SSL Security Token Service CRD delivery mechanism

Things to ponder Validate self issued cards How much do you trust an IP?

Tools Microsoft provide Client Side Kit ASP.NET Kit

Blogs Kim Cameron Vittorio Bertocci Garrett Serack

RP Code for ASP.NET ASP.NET Kit User Control

RP Code for other languages Ruby Java

Identity Providers OpenID & Information Cards Live Labs Beta STS

Questions? “Now, with the debut of the Info­Card identity management system, Microsoft is leading a network-wide effort to address the issue. To those of us long skeptical of the technology giant's intentions, the plan seems too good to be true. Yet the solution is not only right, it could be the most important contribution to Internet security since cryptography.” Lawrence Lessig, Wired Magazine, March 2006.