RE: Online PIN & Server Wallet

[Anders Rundgren <anders.rundgren@xxxxxxxxxx>]

Lyal,

>- Why not have the Server wallet sign on behalf of the cardholder? - they've
>already authenticated themselves by PIN, thuis no need for a personalised
>certificate.

Well, your are right about the server-signature but if you put this statement in the 
IETF-PKIX-list you will get return messages like "not secure", "breaks the intention of PKI" ,
"the user-environment and equipment is more trustworthy than a server" etc.

Naturally these guys will simply be ignored, as today you get computer-generated invoices on
company-papers from energy companies and Telcos. When (if) they convert this into PKI,
I doubt that they will add a human clerk to push "OK" or key PIN-codes for each outgoing
digitally signed invoice.

I do believe though that it would be advantageous (but not absolutely necessary) that users also
performs a signature operation, preferably with the same device and mechanism as they do for
their Internet-banking account.  Here assuming that the server wallet is located at the user's bank
which though may not always be the case.  Some Internet-banks do not require signing yet, and
in those cases your original idea is exactly as good (or bad) as their on-line banking services.

Anders