[3529] in cryptography@c2.net mail archive
Re: bank consortium to form CA
daemon@ATHENA.MIT.EDU (Robert Hettinga)
Thu Oct 22 15:37:04 1998
In-Reply-To: <199810220004.UAA01349@smb.research.att.com>
Date: Wed, 21 Oct 1998 23:52:55 -0400
To: cryptography@c2.net, dcsb@ai.mit.edu,
Digital Bearer Settlement List <dbs@philodox.com>
From: Robert Hettinga <rah@shipwright.com>
At 8:04 PM -0400 on 10/21/98, Steve Bellovin wrote:
> According to the Wall Street Journal (online WSJ subscribers can see
> http://interactive.wsj.com/articles/SB908925664656288500.htm), eight
> banks -- Bank of America, Citibank, Chase Manhattan, Bankers Trust,
> ABN Amro Bank NV, Barclay's PLC, Deutsche Bank AG, and Hypo Vereinsbank AG
> -- are forming a certificate authority consortium.
I tried to do this, once. It didn't work. ;-).
Seriously. Ask Froomkin and Thayer about it.
Well, okay, not *too* seriously, but you get the idea.
I expect that the above is Yet Another Banking Consortium. Navel gazing is
fun, and all, but not usually lucrative.
I mean, I'm still waiting to see if the FSTC can really, commercially,
deliver a glorified SMTP box which will test the "signature" on the
equivalent of a glorified PGP signed message, decrement a glorified DDA GL
entry, and send out a glorified ACH message on a glorified proprietary
network after that. The only people who've managed to do *that* so far have
had a glorified gun at their head and spend untold glorified samoleans for
the privilege. (Well, okay, but the people sending the check *were* in the
Pentagon, right? Maybe they were all in it for all the, uh, glory? :-))
Oh. Right. And then there's the ABA, who are now shocked, absolutely
shocked, that someone would steal *their* "we're going to be the root CA
for the whole financial system" idea, and not at least give *them* credit
for it. :-). Of course, they're probably going to have to fight Verisign
for actual precedence, but, hey, it's all about who can shout the loudest
at the right Congressman, right?
(Just remember, folks, I was there first... Okay, so nobody else was there
but me when I got there. I try to take solice, especially if the above YABC
succeeds, in the fact that Froomkin says that nobody ever *will* be there.
Yeah, I know. It's not the same river it was when you went in, you can only
get halfway there, how many law professors does it take to dance on the
head of a disputation, etc., but I still believe the guy. We're pals, okay?)
Notice some actual data in this otherwise sparse hypothetical: the cost of
a bank being their *own* CA is brutally low, especially since the patent on
good-enough technology expires on the order of n x 10^2 days, and can be
scrawled on a blackboard (so that even a *programmer* can understand it
:-)) in n x 10^1 seconds. Given that, do you think the First National Bank
of Podunk, much less the National Oligopoly Bank of Megapolis, is going to
trust anyone *else's* assertion about who is or is not one of their *own*
customers? I thought not. And, notice, that all a bank cares about is who
*their* customers are. If they deposit a check that bounces, do they really
care who *wrote* the check? No. Not at all. That's the depositor's problem.
The bank just backs the money out of the account. Plus handling charges, of
course.
RSA, and its attendant technologies, are about to become the cotton gin of
cypherspace. Any blacksmith programmer will be able to bang out a working
"CA" -- one capable of checking the signature on a digital check against a
list of authorized depositors, certainly -- in about an afternoon.
So, even if we just *contemplate* the Absolute and Monopolistic Control of
Grand Universal Name Spaces, financial or otherwise, we have finally met
the enemy, ladies and germs, and he is our own facile imagination.
> According to the
> article, the real thing holding back Internet commerce is the lack
> of identity-based certificates...
Book-entry internet commerce, certainly. Can't send someone to jail for
making the wrong book-entry unless you can physically apprehend them and,
um, send them to jail, right? I mean, that's what the government's for,
right? The error-handling "and then you go to jail" part of every
book-entry transaction protocol, yes?
Too bad we have to wait for n x 10^3 days or so for the patent which solves
*that* particular problem to expire...
> On a brighter note, these certificates
> are supposed to embedded on smart cards.
Right. Like I'm supposed to trust a device with no control over its I/O.
I don't think so, Steven. Obviously, I respect you a whole lot, but,
frankly, until we have actual, physical control over the machines which do
the "signing", I ain't "signin'" nothin'.
(Wait. I *do* have physical, I/O, control over a machine which "signs"
things. It's right here, miraculously, under my very fingertips. How
*'bout* that? Tell ya what, that Moore guy really *was* a genius, wasn't
he? How many price-halving cycles do I get to wait before I get what I, um,
really-really want, a small enough form factor? 2? 3? Cool. I can wait 3
years, even 4.5...)
The (rather elliptical) point is, until some bank takes internet check
deposits over the net, *and* makes money at it, there isn't much call for
signing *anything* (anything that a bank wants, anyway) and sending it to a
bank over the net. Might be real soon, now, but it also might be quite a
while, yet, too. I guess I'm still betting on the former, sans, of course,
the aforementioned Internet Financial Certification Authority. (Hey, look.
IFCA. How *about* that? Is there an *echo* in this room, or what?)
Note, for instance, that MOTO rates on internet credit cards will probably
come down once VISA and MC -- and the vending public, more likely -- figure
out that a.) nobody's sniffed a credit card out from under an SSL session
yet, and b.) gadjillions of dollars of transactions are being executed on
the internet and more are coming, forcing c.) actual competition in
internet merchant accounts, even if the banks have to lie to VISA and MC
(by creating discounts elsewhere in their portfolios, say) to make it
happen.
In other words, "Look Ma, no Signatures."
CardService Internatinal isn't going to be the lonely boy with his finger
in the internet commerce dike for too much longer, not if the spam sneaking
past my mail filters lately is any indication. And, you can bet that *that*
bunch isn't even thinking about using something like SET, much less YABC.
They're just going to take the card number and expiration and get on with
the next SSL session.
Cheers,
Bob Hettinga
-----------------
Robert A. Hettinga <mailto: rah@philodox.com>
Philodox Financial Technology Evangelism <http://www.philodox.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
