2. PKI-enabled e-tax in the Netherlands Ir. E.J. Kuiper Ministry of Finance The Netherlands

3. Agenda Current pilots: –AVI, BAPI EU and EESSI work: –Contribution of Directive –EESSI specifications –Priorities for further standardization

4. AVI characteristics Selected entrepeneurs (advanced) Tax declaration for VAT and wages PKI: Entrust PKI suite CA: Interpay, RA: Tax Office Interactive session over Internet On-line payment Soft certificates (no SSCD) NetDynamics infrastructure and development environment First stand-alone, later connected to backoffice (Async. Message queueing)

5. Sassenheim, March 1st 1999

7. Administrative process is complex Software certificates + user errors result in 20 % re-certification / year Juridical Archive: lacking guidelines Organisation / person Separation between authentication and autorisation presents problems Payments did not work out (banking problem) Lessons PKI AVI

8. BAPI characteristics Selected entrepeneurs (advanced) Cooperation with bookkeeping suppliers Tax declaration for Profit PKI: made to measure (BAPI client and gateway) CA: Diginotar, RA: Diginotar Off-line preparation in bookkeeping Soft certificates identify companies Connected to backoffice (Async. Message queueing)

9. BAPI characteristics

10. Lessons PKI BAPI Slow start - dependency on bookkeeping suppliers costs time Life this year No officially accredited CSPs, but 3 which had done an experimental audit Only 1 CSP offered company certificates as a standard offering Client retrieval of CRL presented problems

11. Directive 1999/93/EC Very important with respect to signature for natural persons But business requirements also exist for confidentiality and identification of other objects than natural persons Terminology not in line with accepted terms like CA, RA -> confusion Definitions broad, e.g. CSP

12. Directive 1999/93/EC Open ends: –continuity of CSP business –acceptance of foreign certificates –certification of products –authorization associated with signature

13. Directive 1999/93/EC Common use of signatures is associated with functions, roles, e.g. authorization (Privilege Management Infrastructure): Dear Norien, Kind regards,

14. EESSI specs Result in very high-end requirements -> risk considering lifetime of PKI is finitive Deliver only part of the implementation choices Technical interoperability does not get enough attention Directed at signatures of natural persons (only part of the business requirements for trust)

15. EESSI specs and PKI

16. Priorities Identification of objects, which are not natural persons Transition to QCP + SSCD Requirement: confidentiality only Handling of limited PKIs in American standard software products -> more cooperation with US suppliers and standard groups is needed Authorization linked to PKI identification Solutions for open ends in Directive