Several of our “Babysteps” examine PKI; see the following:
- No. 8: A critical look at Bridge CAs argues that BCAs might not be ideal in non-government environments, because they aim at establishing the equivalence of certificates.
- No. 5: PKI interoperability unpacks how digital certificates can help with the act of authentication and shows it really isn’t complicated.
- No. 4: Exposing some PKI myths acknowledges the grains of truth behind many of today’s misconceptions, and unpacks the real issues.
- No. 1: PKI in health & welfare sets out PKI’s unique ability to secure paperless transactions in the complex, high risk, long lived and multi-party applications characteristic of the health & welfare sector.
A major peer reviewed paper presented at the 7th NIST Symposium on Identity and Trust on the Internet, Gaithersburg, MD, March 2008.
This work draws together most of Stephen’s deep thinking on PKI from over a decade’s work, canvassing the reasons for PKI’s historical difficulties, popular misconceptions, and ways to break the unhelpful nexus between Big PKI and centralised ID systems.Read more
A paper presented to the academic stream of the AusCERT 2005 conference about using anonymous digital certificates to securely convey health identifiers.Read more
We won a series of three competitive commercialisation contracts with U.S. Homeland Security over 2016-19 to develop a verifiable credential mobile wallet for First Responders, based on Lockstep’s low risk decentralised PKI architecture.
More details available here.
This breakthrough paper from 2000 articulated in detail an interoperable PKI where the fitness for purpose and standards-conformance of certificates were evidenced by digital audit certificates. The audit of CAs would be overseen by an ISO 17025 accreditation framework, scalable to build an international PKI under the auspices of existing accreditation bodies.Read more
Appeared in the international Secure Computing Magazine. It argues against one-size-fits-all “identity” certificates, because in business, we do not entertain stranger-to-stranger transactions. The paper also includes a useful taxonomy of electronic signature regulations.Read more
A light touch, standards-based framework for cross-recognition of Certification Authorities that have been externally accredited, thus allowing certificates from one jurisdiction to be used in another. Paper presented to the Attorney Generals Privacy and Security conference, Melbourne, August 2001.Read more
A pioneering paper delivered in 2001 to the Information Security Solutions Europe Conference, London, outlining an international PKI framework.Read more