XKMS extension for authentication key management Dr. David Wen ActivCard, Inc dwen@activcard.com 510-745-6215 Eric Le Saint ActivCard, Inc elesaint@activcard.com 510-745-6211 1. Speaker experience David Wen is a senior security Architect at ActivCard. Before joining ActivCard, he has worked at NASA Software Verification Facility as a member of technical staff, a research scientist at NTT Communications lab in Japan, and Associat professor at Tokyo Science University. He serves as the co-chair of IEEE Enterprise Security Workshop and have been the principle investigator and co-principle investigator for a number of ARPA, NASA and MITI sponsored projects. He has published extensively in the area of computer science and computer security. David Wen obtained his Ph.D from Oxford University in computer science in 1992. 2. Need of ActivCard in XKMS services ActivCard is the leading digital ID management solution provider and has provided smartcard enabled digital ID for DoD, Sun, HP and other organizations. A PKI applet that is compatible with Verisign, Entrust and Baltimore certificate is a standard feature of our product. In addition, ActivCard also plays a leading role in elaborating smartcard interoperability standards for the (GSA) General Services Administration. In current deployment of ActivCard Portal, there is a need to provide card holders with XKMS trusted services to simplify PKI enabled applications. In addition (see below) ActivCard is proposing to extend the XKMS services to enable interoperable smartcard applications for cards issued by different card issuers. 3. The expectation of the final output of the workshop ActivCard does not have enough information at this time to comment on this. We expect our proposal to be met with constructive criticism and to provide an example for further extending XKMS services to help solve real world problems. 4. Potential contribution We are proposing an extension to the XKMS services that can enable interoperable smartcard applications at POS (Point of Service and Point-of-Sale etc). 4.1 Background XKMS is designed to work with XML-DSIG and XML-ENC standards. It enables the recipient of signed and encrypted XML document to process it through delegation of trust related processing to trusted services. Information contained in allows the client to query the trusted service in order to make needed decisions. 2. The problem A similar problem exists in the deployment of smartcard based services. Currently, most smartcard platforms use symmetric keys to mutually authenticate applications residing on smartcard and the service provider through some POS (Point-of-Service) devices or terminals. It is the current practice that service providers maintains seperate keys for their applications and there are multiple applications on the smartcard. It is difficult for the POS to maintain all the mappings of application- service provider locally, let along the keys needed. The question is how do we enable the POS to delegate the authentication processing to the relevant service provider. 3. A proposal To solve this problem, two pieces of information are needed: (1) the POS needs information about application- service provider-key label binding from the smartcard; (2) a reference to a trusted service that can redirect or perform the required authentication to card applications We propose to use the XKMS infrastructure to enable smartcards issued by different issuers to be used by any POS and obtain services locally. To achieve this aim, additional services and protocol must be added to KISS and KRSS. However, the architecture and framework of XKMS can stay intact. ActivCard has developed the necessary infrastructure to allow information described in (1) to be presented to POS when a smart card is inserted. 4. Business analogy The business analogy is the ATM cash machine. There are different ATM cards issued by different financial institutions, but based on the public information given by the card, the ATM machine can route the card to the right bank, and give LOCALLY hard cash. 5. Related technology Currently, there is no secure way for smartcards issued by different issuer to be interoperable, even if they use the same platform such as the VISA Open Platform. It is also almost impossible to provide POS with all the key information required to operate different applications on smartcards issued by even the same issuers.