HKPost plans for e-cert demand rise

[R. A. Hettinga]

http://technology.scmp.com/cgi-bin/gx.cgi/AppLogic+FTContentServer?pagename=SCMP/Printacopy&aid=ZZZPDZ8XCYC





Wednesday, March 13, 2002
HKPost plans for e-cert demand rise


ANH-THU PHAN

Hongkong Post (HKPost) plans to issue a tender for upgrading its electronic
certificate (e-cert) system in anticipation of a heavy increase in use once
identity cards go digital early next year.

Y.C. Lam, senior manager at HKPost's Certificate Authority, the unit in
charge of issuing e-certs, which can be used for authentication and
encryption when conducting business over the Internet, said about 50,000
certificates had been issued and the system's capacity was about 10 times
that number.

HKPost wanted to be prepared for an expected "critical mass of e-certs
issued" when Hong Kong's 6.8 million residents were offered the option of
having digital certificates stored on their ID cards. The certificates
would be offered free for the first year, while each year of renewal would
cost HK$50.

"I think this will be a request for proposals for a technical upgrade of
the system," Mr Lam said. He did not say when the tender would be posted,
but that probably it would be open for the standard government policy of
six weeks.

The present certificate system, built at a cost of HK$55 million by
Hewlett-Packard and GTE Cybertrust, and unveiled in 2000, did not have many
users in its first year because of a lack of applications, Mr Lam said. In
the past year, HKPost introduced specialised certificates issued through
banks and mobile certificates to be used with mobile phones and personal
digital assistants.

To promote the use of digital certificates and digital signatures, the
Government requires them for the submission of documents to Government
departments online and for functions such as the filing of tax returns. A
separate "digital government" system, with kiosks to allow access in public
places such as libraries and Mass Transit Railway stations, was built by
Compaq Computer and makes heavy use of e-certs.

Sin Chung-kai, the legislator representing the information technology
functional constituency, said e-cert adoption rate was too slow, though
their addition to digital ID cards should stimulate use.

Since the Government awarded the first contract for the introduction of
digital identification cards to Pacific Century CyberWorks last month,
several parties have expressed concern about privacy and security related
to the information to be carried on the cards.

Mr Lam said security measures taken in HKPost's present e-cert system were
adequate.

Mr Sin said: "I think our system is properly protected from hacking and
other unauthorised access." He said existing laws prohibited exchange of
Hong Kong residents' personal data between Government departments and that
no new laws were needed to protect privacy with the introduction of digital
ID cards.

However, amendments to the electronic transactions and registration of
persons ordinances are being considered. The change to the transactions law
would put biometrics and personal identification numbers on the same legal
footing as handwritten signatures and digital certificates, while the
changes to the Registration of Persons Ordinance would include limits on
how the personal information could be used.

In the hope of stimulating the use of e-certs, HKPost recently waived
initial fees for businesses registered with the Trade Development Council
at tdctrade.com.

Separately, the Hong Kong University of Science and Technology is setting
up its own smart ID card system for students, staff and faculty. The
multi-application cards are built on the Java platform and support digital
certificates issued by the university.

HKPost's e-certs use public key infrastructure technology, which ensures
that messages and documents have not been tampered with or seen during
transit.


-- 
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at wasabisystems.com