Digital Identity

Conclusion

Integrity, non-repudiation, and confidentiality are important foundational properties in an identity management system. Almost every activity in identity management relies on one of more of these three concepts.

Public-key cryptography and the public-key infrastructure have suffered from over-hype—seen by some as the answer to every security problem that has surfaced over the years. For example, some have proposed the widespread adoption of digital certificates for authentication and authorization tasks. While the technology is theoretically up to the task, these schemes have usually collapsed under the weight of complexity, institutional policy, politics, and the sense that widespread adoption is too expensive or difficult to manage.

As an example, consider the task of using digital certificates to secure access to an online banking service. For a large bank, this means issuing millions of digital certificates and renewing them on a periodic basis. These certificates would need to be installed on client machines and then used and managed by the bank's customers. Automating the process of installing and managing the certificate on the client's machine opens significant holes in the security system, because this automated process could be exploited by attackers to install bogus certificates on unsuspecting customers' machines.

For digital certificates to be effective in an identity infrastructure, users of digital certificate technology need be aware of the certificates ...