RE: A PKI Question: PKCS11-> PKCS12

[lynn.wheeler@xxxxxxxxxxxxx]

try bank debit card infrastructure. there is a hardware token/box that is
protecting  the bank's "key" which then all of the individual account keys
are encoded with. for a large bank, there could be dozens of these hardware
units to handle the debit transaction load. In addition, there are copies
of the keys likely escrowed in some other institution's safe deposit box
(aka keeping the escrow in the same institution's safe deposit boxes could
represent a collusion risk).

It is slightly analogous to a CA model (in that the bank's key is encoding
the account key as opposed to signing the account key) ... except then all
transactions are coming back to the account-authority (i.e. the
account-authority and the relying party are the same), and the hardware box
gets fed the encoded account information, the transaction ... and validates
the transaction.


<ejnorman@xxxxxxxxxxxxx> on 11/28/2001 11:19 AM wrote:


It seems to me that if a corporation has designed its business
practices such that valuable corporate assets pass through a
single point of encryption (aka single point of failure), then
it would be wise for that corporation to review and adjust
its business practices.


Eric Norman

                     "I may be just a butterfly,
                      but watch out if I flap my wingss