The comments to my blog stopped working. I am working on it, but in the meanwhile here there's the answer to a comment left by Matt to my former post on PPID vs UniqueID . Monday, January 15, 2007 6:55 AM by Matt Ellis # re: UniqueID and PPID Hi Vittorio. I'm wondering what happens if the IP's cert changes (perhaps the private key is compromised)? With a bit of co-ordination, you can update your copy of their public key, so you can still verify incoming tokens, but would the unique id now be incorrect? Is this even a situation that can happen? Cheers! Matt Hello Matt, apologies for the delay. We exclude from the discussion the selfissued card case: if the public key changes, this means that the eintire card changed (including the PPID) and it makes sense to ask to repeat the registration. That said: Your unique ID can be a function of the public key of the IP and of the PPID: Uid = F(Pipkey,PPID) In theory, if you (the RP) stored the PPID somewhere (and it didn't change in the process, more about it later) you could just reapply the F above and substitute the Uid value in your store. In practice: when you use a managed card, you can't be sure of what the PPID value will be. Actually, we recommend to IPs to make that claim available but they can choose not to add it at all. For self issued cards the PPID is a function of the cardID and of the public key of the RP: PPID = G(Prpkey,Cardid) Even if we'd apply the same formula for managed cards: the Prpkey may not be available to the
Read More...