Public-Key Management - Everyday Cryptography - page 407

13 . One way of providing conformance between different CAs is to develop
common standards that allow a CA to be measured against current best
practices. Find an example of such a scheme (either national or industry-wide)
and provide information about what it does.

14 . Alice wishes to securely send an important message to Bob, who has a public
encryption key that he generated himself. Neither Alice or Bob are part of any
formal public-key certificate management system and Bob does not intend
to acquire a public-key certificate for his public key. Suggest how Alice might
obtain Bob's public key and acquire sufficient assurance of purpose of this
key if:
(a) Alice and Bob are friends;
(b) Alice and Bob are remote business acquaintances;
(c) Alice and Bob are strangers.
15 . Continuing the theme of the previous activity, even for a large organisation there
are certain situations where it is possible to provide assurance of purpose of a
public key without creating a public-key certificate. Consider how this might be
done for:
(a) the public key of a CA;
(b) an application where all public keys are embedded in hardware (such as
an ATM).

16 . Provide an example of an application where you think identity-based public-
key cryptography (IDPKC) is more suitable for implementation than traditional
public-key cryptography supported by public-key certificates. In particular, for
your chosen application, explain:
(a) the problems of a certificate-based approach;
(b) the advantages of using IDPKC;
(c) how you might overcome some of the practical issues associated with

implementation of IDPKC.
17 . We have only discussed IDPKC encryption in this chapter. It is possible to design
identity-based digital signature schemes.
(a) Describe a model similar to the one in Section 11.4.2 for IDPKC encryption
that explains a potential process by which identity-based digital signatures
might be created and verified.
(b) To what extent do you think identity-based digital signature schemes offer
any benefits compared to conventional digital signature schemes?

18 . Consider the following medium-sized online travel business:

• 160 staff are employed, 40 in the main national office and 15 in each of
eight international offices;
• the company sells package holidays, air tickets, travel insurance and travel
accessories over the Internet;