1. TeleTrusT Initiatives for PKI Solutions
PKI Forum meeting
‚PKI in Europe‘ Dublin, June 27st-29nd, 2000
TeleTrusT Initiatives for PKI Solutions
Helmut Reimer
TeleTrusT Deutschland e. V.

2. TeleTrusT: Association of Competence
Promoting the trustworthiness of information and communication technology
applied Cryptography & Biometrics
founded in 1989
more than 95 members: major user sectors, research organisations, developers and manufacturers of security products, government agencies, and test institutes.
non-profit, political independent

3. TeleTrusT: Working Groups / Projects Interoperability, Standards, Appropriate Security
Legal aspects of the liability of communications (WG1)
Security architecture / IC-Card security (WG2)
Applications in health services (WG3)
Open e-commerce security (WG4)
Promotions (WG5)
Biometrics identification (WG6)
Public key infrastructure (WG7)
MailTrusT (WG8)
Chipcard-terminals (Project, MKT, UCTS)
Project BioTrusT

4. Trustworthy IT
Goals: - privacy / confidentiality - integrity - subscribers identification /authentication
Conditions: - technology accepted publicly - security as a appropriate component of the business processes - the participant has an acting role - clearly recognisable risk spread

5. PKI & DS: Expected fields of application
Private and business communications over the Internet (in connection with encryption).
E-banking (i. e. home banking), e-business, e-commerce with better consumer protection.
Public health services.
Services of communes and authorities for the citizens.
Many (but not all) applications require a legal recognition of the DS

6. PKI & DS-Regulations: The Pros and Cons/I
Advantages
The legal and evidence values of DS should be defined.
The PKI is functional simple.
By a national PKI- policy, the mutual recognition of certificates would be able to be supported
The asymmetric crypto-graphy and their algo-rithms obtains acknow-ledgements by law.
Providers of compo-nents and services and the customers have dependable conditions for investments.

7. PKI & DS-Regulations: The Pros and Cons/II
Disadvantages
The application of DS already requires a complete solution for the start.
Business cases are not in view of the regulations.
Quite difference views on CSP supervising or accreditation.
The governmental-driven applications may be more or less closed shops

8. PKI, DS and E-Commerce Business to Business Business to Consumer
Enterprise and/or Consumer to Authorities or public services
Different security policies, different business conditions, different business cases
Public key infrastructure: One for all?

9. CA Services: Business Case? /I
E. g. Banking Organisations
In house CA services: Cost / benefit relations can be calculated, security policy / business conditions / riscs / assurance conditions can be defined
The costs for the customer can be formed marketably
How can this concept support other applications?

10. CA Services: Business Case? /II
E. g. CA Service Provider
Return of investment?
Costs by regulation (SigG: CA, Directory Services, Chipcard-Personalisation, Time Stamping ...)
How does the integration of the services occur into the business concepts of the users? (E. g. Distribution of costs between different applications)

11. E-Commerce Security / I
Security by regulation:
Evaluation of technical components according to specific criteria (ITSEC, CC, FIPS )
Does so practical security result for an application?
The same level of security - only a result of an unique security policy?

12. E-Commerce Security / II
Security by business conditions:
The practical security of application is the goal
Evaluation of components and the business process according to application specific criteria
Assurance and liability are components of the security policy
Recognition of e. g. other certificates is part of business policy

13. TeleTrusT: Steps 2000 / I
In general: The integration of PKI & DS into applications is much more difficult than expected
TTT is included in the development of national specifications and standards:
Interoperability at PKI-Level (SigI)
Chipcards with DS functionality (DIN-Spec)

14. TeleTrusT: Steps 2000 / II Multifunctional Office Identity Chipcard
Health Professional (Chip-) Card
Evaluation of Chipcards ITSEC E4 high
Generic PKI security policy
Definition of application projects (e. g.
The results should be inserted into international standardization

15. TeleTrusT: Steps 2000 / III What do we need?
Implementations of the DS in applications (reengineering of business processes)
Security oriented Work Flow Systems / reliable archiving
and more general
Application and acceptance experiences

16. TeleTrusT Experiences 2000
MailTrusT - Sphinx: End-to-end-security with PKI for business communications
E-Commerce / E-Business / E-Banking: Different protokolls are in use (e. g. SET, HBCI...) the certification infrastructure establishes itself with application specific certificates
The interoperability and mutual recognition of certificates are current questions