PKI in the Swedish public sector

1. PKI in the Swedish public sector • Decentralised administration - each agency make their own decisions • PKI in different situations: • internally within an agency/authority • between authorities, local and national government • e-services to citizens and industry

2. Background, PKI in Sweden • Electronic id-cards are used internally within the public sector in some large agencies approximately 50 000 cards, for sign on, electronic signatures and disk encryption • Standards for certificates and smart card are defined by the association SEIS. These standards are now being introduced internationally.

3. Current situation PKI • Statskontoret has general contracts for standardised electronic id-card for use internally within the public sector - pilot projects • There is a need for PKI identification of companies and citizens for government electronic services • Several CA:s are active, but most in close environments: internally within large corporations, government agencies, banks

4. Planned e-services g2b g2c • RSV -business monthly tax declaration • RSV-PRV Starting a business • RFV sickness and parent benefits • AMS employer and job seeker communication web sites • CSN student loan system • Real estate board applications

5. Scope Identification E-mail Signed Program- (Interactive web) documents program govement org intranet internal e-mail approvals internal single sign-on expence accounts gov org- decisions decisions SHS-SHS gov org considerations ad- hoc gov- check company matters reports, declaration e-commerce business informationbeslut application gov - check personal matters affirmation citizen information

6. Low cost and ease of use Digipass secure identification. Signatures and identification with soft keys Acceptable security E-services Qualified electronic signatures Signatures and identfication with hard keys

7. Aspects of security Key cannot be copied ”strong” encryption CA supervised Full control of private key Secure signatur device Signing: - data integrity - signature Personal attendance w issued cert

8. Qualified electronic signatus Signatures/ identification soft keys Signatures/ identification hard keys Secure identification digipass Secure signing device CA super-vised Key cannot be copied Key cannot be copied Key cannot be copied Full control of private key Full control of private key Full control of private key Full control of private key Signing: - data integrity - signature Signing: - data integrity - signature Signing: - data integrity - signature Personal attendance w issued cert Personal attendance w issued cert Personal attendance w issued cert Personal attendance w issued cert

9. Suggested idea3 classes of certificates • Class 3: • electronic signatures when signing is required • information that requires a high degree of privacy • smart cards for private keys • issued by personal attendence • Class 2: • sign on • digitial signatures for identification • private keys stored in software • issued by personal attendence • Class 1: • other certificates

10. One certificate format - several packages?? • X.509 v3 • RFC 2459 - PKIX • Swedish standard for electronic ID-cards: SS 61 43 31-32 • Health care certificates • Finnish EID-specs • SAT - testspec for certifikat • Swedish banks’ certificate policy

11. Certificate standards X.509 v3 RFC 2459 Smart card FINEID SS614331-32 (PKCS#11) (PKCS#12) Bank cert PKCS#15

12. Several certificates are needed EID-certidentifies a person w personal id certificate for organisation E-post-certifikat E-post-certifikat E-post-certifikat E-post-certifikat E-mail-certifikat

13. Electronic id-card EID-certidentifierar individ m personnr Organisation certificates