Liability Allocation in a Public Key Infrastructure," which appears in Volume 33 of the San Diego Law Review He serves as Vice Chair of the Electronic Commerce Subcommittee of the American Bar Association's Committee on the Law of Commerce in Cyberspace.
Chapter 8. Client-Side Digital Certificates
In the previous chapter, we looked at digital certificates for organizations. In this chapter, we'll look at how digital certificates can certify the identity of individuals. We'll also walk through the VeriSign Digital ID Center, the first certification authority to offer public services on the Web.
8.1 Client Certificates
A client certificate is a digital certificate that is designed to certify the identity of an individual. As with certificates for web sites, client certificates bind a particular name to a particular secret key. They are issued by certification authorities.
Client certificates have many uses and benefits:
•
Digital certificates can eliminate the need to remember usernames and passwords. You simply sign your digital signature whenever you enter a restricted space.•
Instead of deploying a large distributed database, organizations can simply use a digital certificate issued by a particular CA as proof of membership in that organization.•
Because signing your name with a digital certificate requires access to a secret key, it is harder for groups of individuals to share a single digital ID than it is for a group of people to share a username and password. This is because there are technical barriers to sharing secret keys between users, and because users may be unwilling to share a secret key that is used for more than one application. This is interesting to sites that have per-user charges for distributing information over the Internet.•
Because digital certificates contain a person's public key, you can use somebody's digital certificate to send that person encrypted electronic mail.•
Certificates that denote a person's age can be used for restrictions on sexually oriented material or on chat groups.•
Certificates that denote a person's sex can be used to allow access to "women's only" or "men's only" spaces.By creating strong systems for identifying users, certificates help eliminate anonymity. They do so even more effectively than "cookies." A cookie merely leaves a track of where you have been through a web site. A digital certificate, on the other hand, leaves behind your name, your email address, or identifying information that, by design, can be traced back to you.
Because certificates eliminate anonymity, some Internet users are opposed to certificates, on the grounds that they compromise a user's privacy. Well, of course they do: that's their purpose. As currently constructed, however, certificates are never sent by a web browser without the user's knowledge and permission.
Furthermore, certificates never contain information that is unknown to the user. Of course, both of these conditions could change in the future.
In the long term, Internet users may change their minds about certificates. It's true that a mark of
totalitarian regimes is the issuing of identification cards and strong penalties for the failure to produce those cards when asked. But identification cards also help solidify a strong society and good behavior, largely by giving authorities ways for holding people accountable for their actions. They also permit trust and commerce, which benefit all members of society. Thus, strong identification is likely to become more and more common on the Internet. Digital signatures are likely to be a strong part of any identification infrastructure.
8.1.1 Support for Client-Side Digital Certificates
Client-side digital certificates are supported by Microsoft Internet Explorer 3.0, Netscape Navigator 3.0, and other SSL-based applications. The support consists of four key elements:
Key creation
The browser contains code for creating a public/private key pair, sending the public key to a certification authority in the form of an HTTP POST transaction.
Certificate acquisition
The browser can accept a certificate that is downloaded from the certification authority via HTTP. Challenge/response
The browser can use a stored secret key to sign a randomly generated challenge supplied by a SSL server.
Secure storage
The browser provides a place to store the secret key that is secure. Version 3.0 of Explorer and Navigator allow the key to be stored in an encrypted file. (Netscape Navigator's Security Preferences setting for storing passwords is shown in Figure 8.1.) Future versions of these browsers will allow keys to be stored on floppy disks or in smart cards.
Figure 8.1. Netscape's Security Preferences panel allows you to put a password on your secret keys and cookies
8.2 A Tour of the VeriSign Digital ID Center
VeriSign opened its Digital ID service during the summer of 1996. The center is located at http://digitalid.verisign.com/. Its home page is shown in Figure 8.2.
8.2.1 Generating a VeriSign Digital ID
VeriSign distributes digital certificates (called digital IDs by VeriSign) from its web site. As of December 1996, the web site could create digital certificates for Microsoft's Internet Explorer, Netscape Navigator, and RSA's Secure MIME format.
The VeriSign certificate creation process consists of six steps:
1. You select a Class 1 Digital ID or a Class 2 Digital ID. (For an explanation of these classes, see "VeriSign's Class System" later in this chapter.)
2. You provide identifying information to establish who you claim to be. For a Class 1 Digital ID, VeriSign requires: