<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<link rel="stylesheet" type="text/css" href="CSS/main.css" /><title>Establish Identity Fortress</title>

</head>
<body>
<h1>Establishing your Identity Fortress</h1>
<h2><br />
Congratulations on your decision to own your own information. </h2>
Let's go over the steps by which you'll establish your
Identity Fortress.
<ol style="list-style-type: decimal;">
<li>
<p style="margin-bottom: 0in;">First, we'll create
something called a "stub
certificate," a digital certificate that contains only your name and
email address.</p>
</li>
<li>
<p style="margin-bottom: 0in;">If you don't already
have <font color="#000000">an ID
Commons identity such as OpenID or i-Name we will create one for you.</font></p>
</li>
<li>
<p style="margin-bottom: 0in;"> Since we'll be
assisting you in establishing your claim of
ownership of information about yourself, we'll need a license from you
to use some
of that information in the process. After all, it's your information,
not ours, and we need your permission to use it. </p>
</li>
<li>
<p style="margin-bottom: 0in;"> Ownership of
information is accomplished with two legal devices: copyright and trade
secret.
Since copyright law covers collections of information called "works,"
your work about yourself will take the form of an autobiographical
reference work. It's a collection of facts about yourself, starting
with the information from your birth certificate and from the IDs
you'll present to a notary ("foundational
information.") With your foundational information we'll create a
printable affidavit that you will take to a notary public of your
choice in order to start the process of creating your reliable identity.</p>
</li>
<li>The notary will ask you to recite the affidavit as an oath,
and sign it. The notary will then sign and seal the bottom portion,
called the Jurat or Notarial Certificate.</li>
<li>An Enrollment Officer will then instruct you on creating a
new certificate, one that is much more meaningful than the stub
certificate that you created to get things started. You'll start as you
did in Step 1, but additionally you'll provide a scanned image of your
affidavit and identity credentials to the Certifiction Authority.
Assuming that all is in order, the Certification Authority will sign
your new Class 2 identity certificate.</li>
</ol>
<br />
So our first step will be to
help you establish your Personal Nondisclosure Agreement. Let's take a
look at our recommended terms and conditions for your PersonalNDA: <br />
<br />
<a href="recommended_nda.html" target="_blank"><input value="View Recommended Terms" type="submit" /></a>
Click to read the Recommended Terms and Conditions for your PersonalNDA
<br />
<br />
We recommend that you use those terms and conditions without editing
them, as that will simplify communication between yourself and your
licensees.<br />
<br />
<br />
<a href="make_bio.html"><input value="I accept" type="submit" /></a>
I accept the Recommended Terms and Conditions for my PersonalNDA
<br />
<br />
<input value="Edit" type="submit" />
I would like to edit the Terms and Conditions of my PersonalNDA
<br />
<br />
<br />
<br />
<h3 class="western" style="margin-left: 1.31in; text-indent: -1.32in; margin-bottom: 0.2in;">
2. <font size="4"><u>Generate PersonalNDA</u></font></h3>
<p align="justify"><font color="#000000">Since
the next steps involve
personally identifiable information (PII), and since our promise to
our customer is all about privacy and protection of PII, we must now
create MyOwnInformation including its PersonalNDA &#8211; with ourselves
as the first licensee to allow the sharing of Foundational
Information with the Enrollment Officer and the licensing of the use
of the information for the sole purpose of establishing a reliable
identity for the subjects identity. </font>
</p>
<p align="justify"><font color="#000000"><u><b>Reliable
ID Server
tasks: </b></u></font>
</p>
<ol style="list-style-type: decimal;">
<li>
<p align="justify"><font color="#000000">Explain
standard PersonalNDA language and why it is in the Subject's best
interest not to alter it </font> </p>
</li>
<li>
<p align="justify"><font color="#000000">Instruct
the Subject that the next step is to claim such rights by starting out
with information to be protected, initially certain biographical
information but later to be expanded into a full biography &#8211; and, most
importantly, the license to use such information, whose terms are to be
written in the Personal NDA and License</font></p>
</li>
<li>
<p align="justify"><font color="#000000">Presents
Standard PersonalNDA, prompts for acceptance </font> </p>
</li>
<li>
<p align="justify"><font color="#000000">Fills
in Stub information on PersonalNDA</font></p>
</li>
<li>
<p align="justify">Prompt for Foundational Information
(birth certificate info + forms of ID to be used at enrollment) </p>
</li>
<li>
<p align="justify">Prompt for any modifications to
standard PersonalNDA language</p>
</li>
<li>
<p align="justify">Prompt for initial licensees, the
first of which are Reliable Identities Inc. and StartCom Ltd.
Explaining that now that the info is the property of Subject we need
the license to proceed. Supplicant Relying Party Request is presented;
subject is asked to click, causing his/her new private key to sign the
license. Reliale Identities <font color="#000000">hereby
request license to obtain and use the following information
(hereinafter referred to as Foundational Information) for the purpose
of establishing a reliable identity. Information will be kept and used
as follows [use explained]</font></p>
</li>
<li>
<p align="justify">Explain that this certificate must
be used for login to enrollment services - as opposed to accepting
certs issued from other CAs or self-signed certificates</p>
</li>
<li>
<p align="justify"><font color="#000000">Subject
is instructed on obtaining a Root Certificate from Osmio. NOTE: THIS
WILL BE NECESSARY FOR ALL IE USERS EVEN AT THE START WHEN WE ARE USING
THE STARTSSL ROOT and for a number of years for all browsers after we
start using the Osmio root. Use text from QE about Sources of Trust. </font>
</p>
</li>
<li>
<p align="justify"><font color="#000000">After
the Foundational Information is established and a license is granted
for us to use it, Subject uses the stub certificate to log into in to
the reliable ID enrollment facility. Reliable ID Server tasks: </font>
</p>
</li>
<ol>
<ol style="list-style-type: lower-alpha;">
<li>
<p align="justify"><font color="#000000">Creates
new record of Subject along with Stub Certificate information.</font></p>
</li>
<li>
<p align="justify"><font color="#000000">Enables
the Subject in the directory allowing the subject to be able to
log-in.</font></p>
</li>
</ol>
</ol>
<li style="list-style-type: decimal;">
<p align="justify"><font color="#000000">Explains
Supplicant Request (we will ask for license from you...)</font></p>
</li>
<li style="list-style-type: decimal;">
<p align="justify"><font color="#000000">Presents
Supplicant Request (</font></p>
<ol style="list-style-type: lower-alpha;">
<li>
<p align="justify"><font color="#000000">maintain
info in encrypted form as part of MyOwnInformation</font></p>
</li>
<li>
<p align="justify"><font color="#000000">submit
to Osmio VRD as part of certificate signing request (CSR)</font></p>
</li>
<li>
<p align="justify"><font color="#000000">maintain
as part of Foundational Certificate, to be used only to back up Utility
Certificate, Pseudonym Certificates, and other commonly used
certificates</font></p>
</li>
</ol>
</li>
<li style="list-style-type: decimal;">
<p align="justify"><font color="#000000">Click
yes, license granted, digitally signed by stub certificate</font></p>
</li>
<li style="list-style-type: decimal;">
<p align="justify"><font color="#000000">PersonalNDA
license is digitally signed by Officer of Reliable Identities
(robotically?)</font></p>
</li>
<li style="list-style-type: decimal;">
<p align="justify"><font color="#000000">Supplicant
fills in Foundational Information Form</font></p>
</li>
<li><font color="#000000">Foundational
Information encrypted with stub public key and stored, with the process
explained as it occurs</font></li>
</ol>
<p align="justify"><br />
<br />
</p>
<h3 class="western" style="margin-left: 1.31in; text-indent: -1.32in; margin-bottom: 0.2in;">
<font style="font-size: 28pt;" size="6"><u>3</u></font><font size="4"><u>.
Enrollment</u></font></h3>
<h4><font size="4"><u>3.1 Remote Enrollment
(Val-ID</u></font><font face="Times New Roman, serif"><font size="4"><u>&#8482;</u></font></font><font size="4"><u>)</u></font></h4>
<ol style="list-style-type: decimal;">
<li>
<p>Subject uses stub certificate to access and fill in the
form currently at <a href="http://pkiuniversity.com/">http://pkiuniversity.com</a>
</p>
</li>
<li>
<p>Subject requests remote appointment with EO, enters time
when he or she can be reached by telephone at a phone number that is
published in a publicly available directory</p>
</li>
<li>
<p>Subject is assigned to an EO and given EO email address,
public key and appointment time</p>
</li>
<li>
<p>Subject is instructed to verify contents of Foundational
Information file</p>
</li>
<li>
<p>Subject is instructed to scan identity documents into a
file (if not possible, fax alternative offered)</p>
</li>
<li>
<p>Subject is instructed to encrypt documents using EO's
public key; delete files after encryption</p>
</li>
<li>
<p>EO does reverse phone lookup on phone number to confirm
that it is listed to that individual or to someone with that last name</p>
</li>
<li>
<p>At appointed time, EO calls Subject, gives url to connect
to enrollment page</p>
</li>
<li>
<p>Login is effected using Stub Certificate</p>
</li>
<li>
<p>EO asks Subject to key control number on enrollment page
into telephone handset</p>
</li>
<li>
<p>EO connects to ChoicePoint ProID, ProCheck, or other PII
corroboration service and asks multiple choice questions of Subject,
generating ID score (not available in some countries)</p>
</li>
<li>
<p>If all is kosher, EO directs Subject to generate a new key
pair and CSR</p>
</li>
<li>
<p>Proceed to Certification</p>
<p></p>
</li>
</ol>
<h4>3.2 Face-to-Face Enrollment (Digital Birth Certificate<font face="Times New Roman, serif">&#8482;)</font></h4>
<ol style="list-style-type: decimal;">
<li>
<p style="margin-bottom: 0in;">Subject with Stub
Certificate fills in the form at <a href="http://www.reliableid.com/enroll_forms/index.php">http://www.reliableid.com/enroll_forms/index.php</a>
which </p>
</li>
<li>
<p style="margin-bottom: 0in;">Prompts for
immutable birth certificate information and documentation information</p>
</li>
<li>
<p style="margin-bottom: 0in;">generates a PDF
affidavit file with unique document number</p>
</li>
<li>
<p style="margin-bottom: 0in;">ReliableID site
presents a list of nearby notaries</p>
</li>
<li>
<p style="margin-bottom: 0in;">prompts for
selection of notary</p>
</li>
<li>
<p style="margin-bottom: 0in;">prompts for desired
appointment time and place</p>
</li>
<li>
<p style="margin-bottom: 0in;">sends an
appointment request to chosen notary</p>
</li>
<li>
<p style="margin-bottom: 0in;">upon acceptance by
the chosen notary, emails the affidavit pdf to the notary</p>
</li>
<li>
<p style="margin-bottom: 0in;">emails the
affidavit pdf to subject and to Chief Enrollment Officer&nbsp;</p>
</li>
<li>
<p style="margin-bottom: 0in;">Subject appears for
appointment with Notary Public, takes oath, signs affidavit</p>
</li>
<li>
<p style="margin-bottom: 0in;">Notary Public signs
and
seals Jurat, records affidavit document number</p>
</li>
<li>
<p style="margin-bottom: 0in;">(Can we get the
notary
to make copies of ID documents and fax them to EO?)</p>
</li>
<li>
<p style="margin-bottom: 0in;">(If not,) Subject
goes
through a small wizard for adding his private details and uploading of
various documents including the Notary signed paper. </p>
</li>
<li>
<p>Subject awaits response from an enrollment officer </p>
</li>
</ol>
<h4>3.2.1 Enrollment Officer Attestation to CA</h4>
<h4>3.2.1 Either F2F with EO or remote EO</h4>
<ol>
<li>
<p>(Optional for higher enrollment quality score) EO
contacts
subject, directs him/her to request paper birth certificate from
issuing authority to be sent directly to EO</p>
</li>
</ol>
<ol>
<li>
<p style="margin-bottom: 0in;">(Optional for
higher
enrollment quality score) EO calls subject at appointed time, logs onto
ChoicePoint ProID, ProCheck or other PII corroboration facility, asks
PII corroboration questions. If subject passes, proceed to next step,
otherwise decline to enroll.</p>
</li>
<li>
<p style="margin-bottom: 0in;">(Optional for
higher
enrollment quality score) EO calls subject at appointed time, both log
into Authentify voice recording session, takes voice record.</p>
</li>
</ol>
<h4>3.1.2 Face2Face meeting with EO (NOTE: this is unlikely.
More
likely is the situation where the EO is also a notary)</h4>
<ol>
<li>
<p style="margin-bottom: 0in;">User searches for
an
available enrollment officer in his region. (Similar to the Notary
finder of the StartSSL WoT) </p>
</li>
<li>
<p style="margin-bottom: 0in;">User contacts
enrollment officer through the web based interface </p>
</li>
<li>
<p>User meets enrollment officer </p>
</li>
<li>
<p>proceed to 2.1.4</p>
</li>
</ol>
<h4>3.2.3 Enrollment Officer Attestation without Face2Face
meeting</h4>
<ol start="3">
<li>
<p style="margin-bottom: 0in;">The enrollment
officer
enters his account and dedicated area, examines the uploaded documents,
performs sanity check of the details submitted with that of the
confirmation of the Notary. </p>
</li>
<li>
<p style="margin-bottom: 0in;">The enrollment
officer
verifies the status of the Notary through relevant channels (bar
association or law society) and by verification via phone directly with
the Notary. </p>
</li>
<li>
<p style="margin-bottom: 0in;">The enrollment
officer
updates the list of Notaries we've already seen. This will help in the
future for easier confirmation of point 2. </p>
</li>
</ol>
<h4>3.2.4 EO directs CA to accept CSR from subject</h4>
<ol>
<li>
<p style="margin-bottom: 0in;">The enrollment
officer
confirms the user though the dedicated area of his account.</p>
</li>
</ol>
<p style="margin-bottom: 0in;"><br />
</p>
<p style="margin-bottom: 0in;">Certificates Generated
at
Enrollment </p>
<h4>Digital Birth Certificate</h4>
<ol>
<li>
<p style="margin-bottom: 0in;">After successful
verification, the user should create his certificate. In case of remote
enrollment, we'll have to force the user creating it and prevent from
access and/or from creating any other certificate. In case of face to
face enrollment, the user might do that in front of the enrollment
officer, in case the needed infrastructure (smart card, eToken or
personal laptop) are present with the user (are smart cards a
requirement? I understood it's not.) </p>
</li>
<li>
<p>The creation is done via a small wizard and the
certificate has to be tested to be functional. We'll force this test to
make sure that the certificate was installed correctly at the device. </p>
</li>
</ol>
<h4>Val-ID Certificate</h4>
<p>Val-ID Certificates are issued without a face-to-face
process.
See
TSP for details.</p>
<h4>Certificates that can be Generated Any Time After
Enrollment</h4>
<h4>Utility Certificate</h4>
<p>NOTE: There is some confusion about Utility Certificates.
A
Utility Certificate only exists when there is a foundational
certificate for the subject. The purpose of the UC is to provide
attestation of identity without disclosing all the foundational
information on the subject, which would be a serious breach of
privacy.</p>
<ol>
<li>
<p>After the Foundational Certificate is signed, Subject
requests Utility Certificate that is linked to Foundational Certificate
but does not display details</p>
</li>
<li>
<p>At this stage I guess those are only client certs
(S/MIME)
for various email accounts. Email address must be verified during the
process. This will be done through a simple walk-through wizard.</p>
</li>
</ol>
<h4>Pseudonym Certificates</h4>
<p>These are like Utility Certificates except that a) the
subject
will want many of them and b) the certificate discloses no
information other than the fact that its existence attests to the
fact that there is a linked Foundational Certificate that represents
a real human being. </p>
<h4>Encryption Certificate</h4>
<p>In some situations a separate encryption certificate is
desired,
allowing the Subject to provide a certificate other than the Utility
Certificate to correspondents for encryption purposes only. </p>
<h4>Signing Certificate</h4>
<p>In some situations a separate signing certificate is
desired,
allowing the Subject to use a certificate other than the Utility
Certificate for digital signature purposes only. </p>
<h2><br />
</h2>
<h2><br />
</h2>
<h2><span style="font-weight: normal;">Your
face-to-face
enrollment is a Notarial process, meaning
that you'll have the benefit of the skills of an individual who is
legally required to know how to perform identity verification, and who
as a public official applies the authority of the state to the
enrollment document. Among other things this places you, the enrollee,
under
penalty of perjury for claims made in the oath and accompanying
affidavit.
<b>It is in your interest to ensure that you do not knowingly
enter any false information in this form.</b>
</span><br />
<br />
First, let us know when and where you would like the
enrollment to take place:
<br />
<br />
<form id="timeandplace" method="post" action="">
<p><?php echo inputfield("where","state","City and State where enrollment session is desired:",$missing,"Please enter the name of the location where an enrollment session is desired"); echo "</p><p>"; echo inputfield("when","when","What time of day, or time range, is best:",$missing,"Please enter the date on which you would like to have your enrollment session"); echo "</p><p>"; echo inputfield("phone","phone","Telephone number at which we can contact you:",$missing,"Please give us a phone number so we can make this appointment"); echo "</p><p>"; echo inputfield("email","email","Email address:",$missing,"Please give us your email address for further contact"); ?></p>
<p><input name="send" id="send" value="Schedule enrollment session" type="submit" />
</p>
</form>
<br />
<br />
</h2>
<h1>Affidavit Form</h1>
<h2>Complete this form to generate the affidavit that will be
used at your enrollment session.</h2>
<div id="wrapper">
<?php if ($_POST && isset($missing)) { ?>
<p class="warning">Please complete the missing item(s)
indicated.</p>
<?php } elseif ($_POST && $pdfmade) { ?>
<p><strong>Your affidavit has been created.</strong></p>
<?php include('includes/mail.inc.php'); } ?>
<form id="feedback" method="post" action="">
<p><?php echo inputfield("name","name","Full Name:",$missing,"Please enter your name"); echo "</p><p>"; echo inputfield("state","state","City and state to be enrolled in:",$missing,"Please enter the state you will be enrolling in"); echo "</p><p>"; echo inputfield("county","county","County to be enrolled in:",$missing,"Please enter the county you will be enrolling in"); echo "</p><p>"; echo inputfield("address","address","Home Address:",$missing,"Please enter your address"); echo "</p><p>"; echo inputfield("birthdate","birthdate","Birthdate:","Please enter your birthdate"); echo "</p><p>"; echo inputfield("birthplace","birthplace","Place of birth (city and state):",$missing,"Please enter your birthplace"); echo "</p><p>"; echo inputfield("mom","mom","Mother's full name:",$missing,"Please enter your mother's full name"); echo "</p><p>"; echo inputfield("dad","dad","Father's full name:",$missing,"Please enter your father's full name"); echo "</p><p>"; echo inputfield("license","license","Driver's license number",$missing,"We need some credential which asserts your identity"); echo "</p><p>"; echo inputfield("licensestate","licensestate","State issuing driver's license",$missing,""); echo "</p><p>"; echo "If you do not have a driver's license, then please give us at least one of these credentials:"; echo "</p><p>"; echo inputfield("passport","passport","Passport",$missing,""); echo "</p><p>"; echo inputfield("military","military","Military ID",$missing,""); echo "</p><p>"; echo inputfield("issued","issued","Date Issued:",$missing,""); echo "</p><p>"; echo inputfield("expires","expires","Date of Expiration:",$missing,""); echo "</p><p>"; echo inputfield("eyes","eyes","Eye Color:",$missing,""); echo "</p><p>"; echo inputfield("height","heigher","Height:",$missing,""); echo "</p><p>"; echo inputfield("race","race","Race:",$missing,""); echo "</p><p>"; echo "Optional Items"; echo "</p><p>"; echo inputfield("birthaddress","birthaddress","(optional) Address at time of birth:",$missing,"Please enter your address at the time you were born"); echo "</p><P>"; echo inputfield("nickname","nickname","(optional) Aliases, Nicknames:",$missing,"Please enter all of your aliases"); echo "</p><p>"; echo inputfield("social","social","(optional) Social Security number:",$missing,"Please enter your social security number"); ?></p>
<p>
<input name="send" id="send" value="Generate and send affidavit" type="submit" /></p>
</form>
</div>
</body></html>