1. Certificate and Key Storage Tokens and Software
Mark Swyers
VeriSign, Inc.

2. Key Storage Considerations
Many different ways to store a certificate and private key
Application will usually dicatate the appropriate method
Concerns include:
Security
Portability
Functionality
Usability
Managability
Expense

3. Software-Based Certificates
Several different software stores
Microsoft CAPI
Netscape certificate database
Macintosh keyring
Java keystores
Vendor specific
VeriSign Personal Trust Agent
Pros
Browser based, so easy to use
Inexpensive
no new infrastructure
easy distribution
Cons
Locks user to desktop
Desktop management
Cannot control password use

4. PKI Tokens
Generally provide greater security than software certificates
Can require PINs or passwords, even biometric authenication
Keys usually cannot be exported
Tokens can be locked in a safe when not in use
FIPS (Federal Information Protection Standard) 140 rated
Provide better portability than software certificates
Can be used on multiple machines while maintaining only one copy of the private key
Have the capcaity to hold multiple keys and certificates
Challenges
Typically require installation of drivers
May require a separate reader
End user acceptance
Token lifecycle management: distribution, forgotten/lost/broken tokens
Cost

5. Smart Cards Can support multiple forms of access Can double as ID card
Physical access to building
Logical access to workstation
Can double as ID card
Can print photo and other info
Can support a magnetic stripe
Requires a reader
Contact or contactless (proximity)
Examples
FIPS 201 standard for HSPD-12
DoD Common Access Card
DOI Employee ID Cards
University ID cards

6. USB Tokens Many form factors Easily portable
PKI only
PKI with One-Time Password
PKI with OTP and storage
Easily portable
Ensures tokens travel with user (i.e. when attached to car keys)
Most computers have USB ports
Better for consumers and when you don’t have control over the user environment

7. VeriSign Approach – Flexible Authentication Platform
PKI-USB Token
Cost-Effective OTP
Multi-Function Token (OTP & USB Smart Card)
Smart Card For Physical & Network Access
VeriSign Unified Authentication
Multi-Function Token with Secure Storage
VeriSign has a unique approach to this problem, by bringing out an authentication platform based on open standards that allows the flexibility to use many different types of devices at a fraction of the cost with the ability to add as new Oath compatible solutions become available.
So let’s look at the solution in more detail:
Mobile Devices
Soft Certificate And Soft OTP
Many Credential Types – One Integrated Platform – One Strategic Vendor