<table cellspacing="0" cellpadding="0" border="0" ><tr><td valign="top" style="font: inherit;"><font face="arial" size="2">Ali and Brian +1</font><div style="font-family: arial; font-size: 10pt;"><br></div><div style="font-family: arial; font-size: 10pt;">CCK can be the CA for the government but there has to be Private Sector based CAs as well to avoid conflict of interest. What may seem complex when broken down may not be all that bad as evidenced in this paper:</div><div style="font-family: arial; font-size: 10pt;"><br></div><div><font face="arial" size="2">http://www.articsoft.com/whitepapers/AustPKI03SMr2.pdf</font></div><div><font face="arial" size="2"><br></font></div><div><font face="arial" size="2">I especially like the not always waiting for the government "</font>The business and Internet communities are not waiting for
some over-arching system to be put into</div><p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal">place by governments or agencies such as the UN. They are
seizing opportunities as they arise, putting in place systems that they trust and selecting their
own RCA – a PRIVATE RCA – if they select one at all. An example of this is the Secure
Electronic Transaction (SET) PKI developed by Visa and MasterCard. Figure 4 represents the basic SET PKI
as identified by Ford & Baum. A new version of the SET protocol has recently been introduced,
sometimes referred to as 3DSET. It</p><p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal">expects to provide the customer with a provable digital
receipt for a transaction, establishing the formality of the contract between the customer and the
merchant, something that was lacking in the original implementation."</p><div><font face="arial" size="2"><br></font></div><div><p class="MsoNormal">VISA introduced 3D SET in 2000 to address issues with SET PKI. </p><p class="MsoNormal">3D SET simplifies the SET protocol into three domain Model:</p><p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"> 1) acquirer domain,<o:p></o:p></p>
<p class="MsoNormal"> 2) issuer domain,<o:p></o:p></p>
<p class="MsoNormal"> 3) interoperability
domain.<o:p></o:p></p>
<p class="MsoNormal">3D SET provide a flexible framework that allows banks and
acquirers to use their method to authenticate cardholders and merchants in a
transaction.</p><p class="MsoNormal"><br></p></div><div><font face="arial" size="2">--- On </font><b style="font-family: arial; font-size: 10pt;">Thu, 3/21/13, Ali Hussein <i><ali@hussein.me.ke></i></b><font face="arial" size="2"> wrote:</font><br><blockquote style="font-family: arial; font-size: 10pt; border-left-width: 2px; border-left-style: solid; border-left-color: rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"><br>From: Ali Hussein <ali@hussein.me.ke><br>Subject: Re: [kictanet] [Skunkworks] Fwd: Kenya’s PKI Destined for Failure?<br>To: lkimani@yahoo.com<br>Cc: "KICTAnet ICT Policy Discussions" <kictanet@lists.kictanet.or.ke><br>Date: Thursday, March 21, 2013, 7:24 AM<br><br><div id="yiv1146126489"><font face="georgia,serif">Adam +1<br><br>And I give Brian the highest commendation for highlighting this issue. We must always try our level best to embrace the Multi-Stakeholder regime because as much as sometimes it sound
like we are in the Tower of Babel ultimately the best solutions emerge (most of the time).<br>
<br>Regards</font><font><b><span style=""><br><br>Ali
Hussein</span></b></font><div><p style="margin:0in 0in 0.0001pt;"><font><b><span style="">CEO, 3mice interactive media ltd</span></b></font></p><p style="margin:0in 0in 0.0001pt;">
<font><b><span style=""><b><span style="">Partner, </span></b>Telemedia Africa Ltd<br></span></b></font></p>
<font>
</font><p style="margin:0in 0in 0.0001pt;"><font> </font></p><p style="margin:0in 0in 0.0001pt;"><font><span style="font-family:georgia, serif;"><span>T<font>el: +25471360<font>1113</font></font><br></span></span></font></p>
<p style="margin:0in 0in 0.0001pt;"><font><span style="font-family:georgia, serif;"><span>Twitter: @AliHKassim</span><span></span></span></font></p><font><span style="font-family:georgia, serif;">
</span></font><p style="margin:0in 0in 0.0001pt;"><font><span style="font-family:georgia, serif;"><span>Skype: abu-jomo</span></span></font></p><p style="margin:0in 0in 0.0001pt;"><font><span style="font-family:georgia, serif;"><span>LinkedIn: <a rel="nofollow" target="_blank" href="http://ke.linkedin.com/in/alihkassim">http://ke.linkedin.com/in/alihkassim</a></span><a rel="nofollow" target="_blank" href="http://ke.linkedin.com/in/alihkassim"><span style="color:windowtext;text-decoration:none;"></span></a></span></font></p>
<font><span style="font-family:georgia, serif;"></span></font><p style="margin:0in 0in 0.0001pt;">
</p><font><span style="font-family:georgia, serif;"><span>Blog: <a rel="nofollow" target="_blank" href="http://www.alyhussein.com">www.alyhussein.com</a></span></span></font><span style="font-size:11.0pt;"></span><span style="font-size:11.0pt;"></span>
<span style=""></span></div>
<br><br><div class="yiv1146126489gmail_quote">On Thu, Mar 21, 2013 at 12:58 PM, Adam Nelson <span dir="ltr"><<a rel="nofollow" ymailto="mailto:adam@varud.com" target="_blank" href="/mc/compose?to=adam@varud.com">adam@varud.com</a>></span> wrote:<br><blockquote class="yiv1146126489gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div dir="ltr">I think Brian's original point is well taken. It's not ideal for a Korean government agency to hold such important keys. However, Kenya can't just start its own key without at least a few years of lead time to get on a critical mass of browsers and operating systems by default (although it should start now just to get the ball rolling). Finland and Turkey have CAs (although Turkey's was famously hacked with <a rel="nofollow" target="_blank" href="http://google.com">google.com</a> signatures).<div>
<br></div><div>I would suggest that the certificate authority for this be one of the most trusted and common commercial ones - Equifax. That's what Google uses and because they're commercial, will probably be more responsive to the needs of the government than a Koren agency.</div>
<div><br></div><div>-Adam</div></div><div class="yiv1146126489gmail_extra"><br clear="all"><div><div dir="ltr"><div><span style="font-family:arial;font-size:small;"><a rel="nofollow" target="_blank" href="https://twitter.com/varud">https://twitter.com/varud</a></span></div>
<div><span style="font-family:arial;font-size:small;"><a rel="nofollow" target="_blank" href="https://www.linkedin.com/in/adamcnelson">https://www.linkedin.com/in/adamcnelson</a></span><br></div></div></div>
<br><br><div class="yiv1146126489gmail_quote"><div><div class="yiv1146126489h5">On Thu, Mar 21, 2013 at 12:32 PM, Kivuva <span dir="ltr"><<a rel="nofollow" ymailto="mailto:Kivuva@transworldafrica.com" target="_blank" href="/mc/compose?to=Kivuva@transworldafrica.com">Kivuva@transworldafrica.com</a>></span> wrote:<br>
</div></div><blockquote class="yiv1146126489gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div><div class="yiv1146126489h5">
Good points from Brian and Evans.<div><div><br></div><div>I think the elephant in the room is<span><font face="arial, sans-serif"> CCK to be the Root Certification Authority. PPP as Brian puts it might be the best way to go, although it has its own challenges, as we saw last year when KENIC was facing leadership challenges, and discord within the board. Other channels might be to tender for local companies to bid to be the RCA. This has worked very well in developed countries.</font></span></div>
<div><span><font face="arial, sans-serif"><br></font></span></div><div><font face="arial, sans-serif">The issue of HR can be sorted if we are willing to empower our youth, by say Knowledge Transfer. Unfortunately, these Asians are not very keen in transferring such knowledge to the client side of the business since they want to be indispensable. But we can be forceful, and find ways to train people who will administer the </font><span style="font-size:13px;font-family:arial, sans-serif;">NPKI system. We currently have thousands of security experts in the country, and we are willing to learn more.</span></div>
<div><font face="arial, sans-serif"><br></font></div><div><font face="arial, sans-serif">Kind Regards.<span><font color="#888888"><br></font></span></font><span><font color="#888888"><div><br>
</div>-- <br>______________________<br>Mwendwa Kivuva<br><br>
</font></span></div></div>
<br></div></div>_______________________________________________<br>
skunkworks mailing list<br>
<a rel="nofollow" ymailto="mailto:skunkworks@lists.my.co.ke" target="_blank" href="/mc/compose?to=skunkworks@lists.my.co.ke">skunkworks@lists.my.co.ke</a><br>
------------<br>
List info, subscribe/unsubscribe<br>
<a rel="nofollow" target="_blank" href="http://orion.my.co.ke/cgi-bin/mailman/listinfo/skunkworks">http://orion.my.co.ke/cgi-bin/mailman/listinfo/skunkworks</a><br>
------------<br>
<br>
Skunkworks Rules<br>
<a rel="nofollow" target="_blank" href="http://my.co.ke/phpbb/viewtopic.php?f=24&t=94">http://my.co.ke/phpbb/viewtopic.php?f=24&t=94</a><br>
------------<br>
Other services @ <a rel="nofollow" target="_blank" href="http://my.co.ke">http://my.co.ke</a><br></blockquote></div><br></div>
<br>_______________________________________________<br>
kictanet mailing list<br>
<a rel="nofollow" ymailto="mailto:kictanet@lists.kictanet.or.ke" target="_blank" href="/mc/compose?to=kictanet@lists.kictanet.or.ke">kictanet@lists.kictanet.or.ke</a><br>
<a rel="nofollow" target="_blank" href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
<br>
Unsubscribe or change your options at <a rel="nofollow" target="_blank" href="https://lists.kictanet.or.ke/mailman/options/kictanet/info%40alyhussein.com">https://lists.kictanet.or.ke/mailman/options/kictanet/info%40alyhussein.com</a><br>
<br>
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.<br>
<br>
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br>
</blockquote></div><br>
</div><br>-----Inline Attachment Follows-----<br><br><div class="plainMail">_______________________________________________<br>kictanet mailing list<br><a ymailto="mailto:kictanet@lists.kictanet.or.ke" href="/mc/compose?to=kictanet@lists.kictanet.or.ke">kictanet@lists.kictanet.or.ke</a><br><a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br><br>Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/lkimani%40yahoo.com" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/lkimani%40yahoo.com</a><br><br>The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and
development.<br><br>KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.</div></blockquote></div></td></tr></table>