http://www.no2id.net/newsblog/2006-12/uk-government-reports-on-changes-to-id-scheme/ The latest on Identity Cards and Databases in the UK Mon, 06 Feb 2012 10:28:41 +0000 http://wordpress.org/?v=2.8.5 hourly 1 http://www.no2id.net/newsblog/2006-12/uk-government-reports-on-changes-to-id-scheme/comment-page-1/#comment-49321 David Moss Sat, 06 Jan 2007 16:00:44 +0000 http://www.no2id.net/news/newsblog/?p=504#comment-49321 Unfortunately, I see no evidence of a "downgrading" nor of a "substantial retreat". Irisprints have not been excluded, as Mr Titterington admits, and facial geometry and fingerprints are still there. None of these biometrics is reliable enough to base an identity voucher scheme on, please see http://dematerialisedid.com/Biometrics.html, but our money is being wasted on deploying them anyway. It depends where you start from, of course, but for me the interesting point in the Strategic Action Plan was the confirmation at last that PKI is being implemented in the biometric passport scheme and will be implemented in the ID cards scheme. Until this report was published, the Home Office had, for four years, confused security with biometrics. This at last gives us the opportunity to measure the Home Office implementation of PKI against the standards set by GCHQ, who invented it. Do that measurement, perform that review, and you find that the Home Office implementation falls spectacularly below GCHQ's standards, please see http://dematerialisedid.com/PKI.html. It fails the authentication test and the confidentiality test. It will have trouble meeting the integrity test and the availability test. It may or may not pass the non-repudiation test, but we don't want it to pass that one anyway. Unfortunately, I see no evidence of a “downgrading” nor of a “substantial retreat”. Irisprints have not been excluded, as Mr Titterington admits, and facial geometry and fingerprints are still there. None of these biometrics is reliable enough to base an identity voucher scheme on, please see http://dematerialisedid.com/Biometrics.html, but our money is being wasted on deploying them anyway.
It depends where you start from, of course, but for me the interesting point in the Strategic Action Plan was the confirmation at last that PKI is being implemented in the biometric passport scheme and will be implemented in the ID cards scheme. Until this report was published, the Home Office had, for four years, confused security with biometrics.
This at last gives us the opportunity to measure the Home Office implementation of PKI against the standards set by GCHQ, who invented it.
Do that measurement, perform that review, and you find that the Home Office implementation falls spectacularly below GCHQ’s standards, please see http://dematerialisedid.com/PKI.html. It fails the authentication test and the confidentiality test. It will have trouble meeting the integrity test and the availability test. It may or may not pass the non-repudiation test, but we don’t want it to pass that one anyway.

]]>