The Quiet Enjoyment Infrastructure (QEI)
The PEN component

Let’s recap.

The City of Osmio is the capital of a community called The Authenticity Alliance. The Authenticity Alliance is here to establish Authenticity. What are we setting out to accomplish?

PKI has not fulfilled its promise for a number of reasons.

One of those reasons is reflected in what the initials have traditionally stood for: Public Key Infrastructure. Public keys are useless without their corresponding private keys. Yet the private key (which in the Authenticity Infrastructure is called the Personal Endorsement Number or PEN™) is typically not part of the PKI specifications. If the PENs are not established and managed in a way that truly isolates them and yet makes them available when needed, that PKI will not work. That’s particularly true of ID-PKIs such as the Authenticity Infrastructure, where everything is based upon identity certificates. And In other forms of PKI where private keys are used only to identify machines rather than people – well, where does the accountability and authenticity come from?

Some QEI terminology

In the Quiet Enjoyment Infrastructure, PKI stands for Puzzle Kit Infrastructure rather than Public Key Infrastructure. Not only does this allow for the inclusion of private key (PEN) management in the spec, but it helps to explain PKI to a world that has been unnecessarily confused by traditional PKI nomenclature. That is, in PKI one either makes a puzzle with a public key so that only the owner of the corresponding private key (PEN) can solve it, or one makes a puzzle with a private key (PEN) such that anyone can solve the puzzle with the corresponding certified public key to know that it originated with the owner of the private key or PEN.

Private keys are referred to as Personal Endorsement Numbers – PENs – to remedy the illogical and confusing usage of the term “certificate” when the speaker really means “private key.” Thus, one signs a message or file with a PEN™ (or PEN®, as we have applied for US federal trademark registration.)

What the rest of the PKI community refers to as the “public key” we call the Personal Certification Number, or PCN. People know what a number is, so why confuse them by calling a number a “key?”

Osmium

Osmium in a token

Running in a token, Osmium can:

• Receive data (files and requests) via its contacts from a host
• Determine what operation is being requested by received data
• Take input from a fingerprint reader that is integral to the token
• Take input from a fingerprint reader that is integral to the token
• Perform matching operations on biometrics and PINs
• Determine which private key should be used in encryption of challenge data or other data
• Determine whether biometric and PIN input warrants the use of the required PEN (private key)
• Display images and/or data on a display that is integral to the token
• Perform or decline to perform encryption and/or hashing procedure
• Send results of cryptographic operations via the token's contacts or via its NFC, IrDA, FeliCA, or ZigBee wireless RFID connections.

Authentication requests in the form of challenges may come to Osmium from a reception area, an outdoor space, and the response may be sent to the same reception area. Otherwise, Osmium communicates only with things in indoor spaces.

Osmium only honors identity certifications that are signed by the Osmio Vital Records Department and accompanied by an Identity Quality score.

The PEN is personal

The writing of this specification was begun on one of two identical laptop computers. One evening it was left, open and turned on, right underneath a pipe that would start leaking that night. The motherboard didn’t survive but the hard drive did, so the hard drive was simply moved to the unharmed laptop.

Like all computers that have seen regular use, the second laptop had its quirks and scratches that had always served to identify it. Now all of a sudden it had adopted the personality and identity of the first one, including its cookie files, certificates, address book, etc. But to a network, it was the machine with the MAC address and motherboard of a completely different computer. So which computer was it? If we’re going to use the identity of a computer as a security element, which computer are we talking about?

That episode illuminates one problem with identifiers of objects. Objects can be cut up into more objects or merged with other objects, changing their essential nature. An object might be a corporation, such as Toysmart for example. Toysmart had a good privacy statement and a record of integrity in honoring the provisions of that statement – until it ran out of cash. Then that record of integrity became nothing more than a fungible asset, valuable to an acquirer who needed an integrity asset because – what else – the acquirer lacked such an asset.

How do you hold such an object accountable for its actions? With lawyers, of course. Lots of them. And lots and lots of court time. What about a digital object inside a computer? Do we have little digital micro-lawyers fighting it out in virtual courtrooms in front of avatar judges?

By contrast with an object, a person can be accountable for their actions in a comparatively simple manner. Therefore, the solution to the problem of accountability is to bind objects to accountable human beings. When you register your car so that it can be driven on public roadways, you are establishing yourself as the party who is accountable for that object.

The PEN represents the person, not the device. In the Enrollment and Identity Reliability Components we will see that one person can be represented by dozens or even hundreds of different personas.

Utility credentials Personas

Bill Gates once famously proclaimed that “your computer should be as personal as your underwear” as a means to establish security.

In the online world, that is the job of the PEN® System.

Now where did I put my keys?

Probably the most secure type of computer is something called an HSM, which stands for Host Security Module or Hardware Security Module, depending upon which security conference you hang out at.

An HSM is a small server on a company's network where the organization’s cryptographic keys are kept, and made available to the right people and the right operations at the right time for the right purposes. An HSM can also perform encryption, decryption and signing operations much faster than would a general purpose processor on the network it serves. The Osmio Wallet may be thought of as an HSM that may be stuck on the back of a phone, or kept like a credit card in one’s wallet, or may take another, usually portable, form factor. Rather than being wired into a network, this HSM communicates via RFID or Bluetooth.

Other problems solved with the PEN component

There is a long history of products attempting to use PKI construction materials without the things that turn construction materials into habitable real estate, will fall short. They are insufficient for three reasons:

• Trust is a much bigger deal than consensus. Market share, cash on balance sheet, and presence on desktops do not equal authority. And while it's commendable that Palladium will go the extra step to accommodate trust infrastructures from consortia such as the Trusted Computing Platform Alliance (TCPA), such consortia have only enough authority for industry players to trust their standards for the next few months. That's completely different from the kind of trust we place, quite rightly, in the agencies that issue passports, drivers' licenses, and certified copies of birth certificates.
• Identity belongs to a person, not a computer or phone. Palladium shows the influence of the one who was Microsoft's Chief Software Architect at the time it was designed, as expressed in a quote that seems to have disappeared from the Internet: "Your computer should be as personal as your underwear." Authenticate the computer, and you've authenticated the user, or so goes the theory.

At first the theory does seem to hold with phones rather than computers. But because phone operating systems can be as powerful as any operating system, they provide thousands of ways for attackers to defeat the intentions of the developers who tried to make them secure.

As anyone who has ever shared a computer knows, that theory never matched reality. People share computers in offices and homes. The gap has only widened as public information terminals have proliferated in airports, libraries, waiting rooms and Internet cafés.

• It puts a commercial enterprise in a place of governance over our information and communication. We've always been down on some master's plantation as long as we have used commercial operating systems such as Windows or OS X. Palladium makes the plantation more secure, and gives da massah some extra tools – to protect us from intruders, sure; but also to control us more effectively.

A good design from someone whose intentions are to oppress does not have to stay in the hands of the oppressor. What would happen if something that looks and works like Palladium were owned and governed by those who use it, in precisely the same way that a municipality in a democracy is owned and governed by its residents?

If you look at the way the problem of identity-based authenticity has been addressed in the past, you find that the pieces of the solution were developed long before Charles Babbage envisioned the first digital computer.

Keeping the keys

Other means of keeping cryptographic keys isolated in firmware, inaccessible to any operating systerm or other software running on the host personal computer or phone, have been developed. UEFI Secure Boot, for example, is the latest evolution of Intel's EFI system for making the boot process more secure and more reliable. However, UEFI is not a real substitute for Palladium.

TPM provides a viable device for isolating cryptographic keys, and it is built into a large number of personal computers. That's the hard part, and it is done. Doing what Palladium set out to do is just a matter of having the will to do it. If you believe that we need to fix the world's information infrastructure, then let your voice be heard on crypto key isolation.

Whether the components of the PEN® System come from Phoenix or TCPA or Embassy Trust or Microsoft Palladium or LaGrande, or a software-based approach such as OpenBSD’s or Java’s isolated memory, it’s all worthless without a certification process that invokes, and is predicated upon, legitimate authority.

So let’s go get some legitimate authority.

The Osmio VRD Wallet™

• Mobile with Bluetooth LE for low power usage and massive battery life
• Credit card form factor
• Use by itself or stick it onto the back of a phone
• 4 mm thin
• 2" full matrix advanced e-paper display
• Supports 1 factor, 2 factor, 3 factor and 4 factor Utility Puzzle Kits
• Supports hundreds of Utility Puzzle Kits (authentication, signing, encryption, etc.)
• Supports Professional License Puzzle Kits
• Sufficiently isolated and secure to store a copy of your Foundational Puzzle Kit if desired
• Virtually indestructible shockproof & weatherproof metal case
• Can be charged with any micro-USB cable
• Extra flat form factor cables with reversible heads included
• Multiple languages supported
• Display and sign free-form messages with your address key - proving your identity
• Multiple layers of PIN protection for the device, utility puzzle kits, bitcoin wallets, and even for individual bitcoin transactions
• Device verification- set a custom phrase to be displayed after entering your personal passcode
• NIST certified True Random Number Generator for puzzle kit generation on the wallet
• Osmio Wallet also serves as a host for Bitcoin wallets (in fact that's the original purpose of the device)
• Hidden bitcoin wallets - hidden wallet data is indistinguishable from random bytes - only the user can know they are there
• Emergency PIN irrevocably wipes all user data
• Fine leather protection case included
• Stylish and advanced design
• Fully BIP32 & BIP39 compliant
• Lightweight yet robust at only 25 g

The wallet can attach to the phone via a credit card holder that sticks on the back of a phone, or it may be attached directly using adhesive. It’s a bit thick, but overall not bad. Soon, this increasingly cashless age will allow us to seriously consider getting rid of the old leather wallet.

Battery charging is not as critical as it may seem, as the Wallet consumes very little power. A usb cable can connect the Osmio VRD Wallet to the phone for charging, but in the future we will need to devise a way to charge the Wallet at the same time as the phone, perhaps with a Y cable.