Free Access

Toward a Public-Key Management Framework for Virtual Assets and Virtual Asset Service Providers

Thomas Hardjono

https://orcid.org/0000-0001-7396-7640

MIT Connection Science & Engineering, Massachusetts Institute of Technology, Cambridge, MA 02139, USA

E-mail Address: hardjono@mit.edu

Corresponding author.

Search for more papers by this author

Alexander Lipton

https://orcid.org/0000-0003-4120-6884

MIT Connection Science & Engineering, Massachusetts Institute of Technology, Cambridge, MA 02139, USA

E-mail Address: alexlip@mit.edu

Search for more papers by this author

, and

Alex Pentland

MIT Connection Science & Engineering, Massachusetts Institute of Technology, Cambridge, MA 02139, USA

E-mail Address: pentland@mit.edu

Search for more papers by this author

https://doi.org/10.1142/S2705109920500017Cited by:8 (Source: Crossref)

Abstract

The recent Financial Action Task Force (FATF) Recommendations define virtual assets and virtual asset service providers (VASPs), and require under the Travel Rule that originating VASPs obtain and hold the required and accurate originator information and the required beneficiary information on virtual asset transfers. In this paper, we discuss the notion of key ownership evidence as a core part of originator and beneficiary information required by the FATF Recommendations. We discuss the approaches to securely communicate the originator and beneficiary information between VASPs, and review the existing standards for public-key certificates as applied to VASPs and virtual asset transfers. We propose the notion of a trust network of VASPs in which originator and beneficiary information, including key ownership information, can be exchanged securely off-chain while observing the individual privacy requirements.

Keywords:

References

Androulaki, E., A. Barger, V. Bortnikov, C. Cachin, K. Christidis, A. De Caro, D. Enyeart, C. Ferris, G. Laventman, Y. Manevich, S. Muralidharan, C. Murthy, B. Nguyen, M. Sethi, G. Singh, K. Smith, A. Sorniotti, C. Stathakopoulou, M. Vukolić, S. W. Cocco, and J. Yellick, 2018, Hyperledger Fabric: A Distributed Operating System for Permissioned Blockchains, in Proceedings of the Thirteenth EuroSys Conference, ACM, New York, NY, USA, pp. 30:1–30:15. Crossref, Google Scholar
Apple Inc., 2019a, Apple Public CA Certification Practice Statement, Certificate Practices Statement, June, available at: https://images.apple.com/certificateauthority/pdf/Apple_Public_CA_CPS_v4.2.pdf. Google Scholar
Apple Inc., 2019b, Apple PKI, Root Certificates, June, available at: https://www.apple.com/certificateauthority/. Google Scholar
Atkins, D., W. Stallings, and P. Zimmermann, 1996, PGP Message Exchange Formats, IETF Standard RFC1991, August, available at: http://tools.ietf.org/rfc/rfc1991.txt. Google Scholar
Barker, E., 2016, Recommendation for Key Management (Part 1: General), NIST Special Publication 800-57, Part 1, Revision 4, National Institute of Standards and Technology, Gaithersburg, MD. Google Scholar
Barker, E., M. Smid, and D. Branstad, 2015, A Profile for U.S. Federal Cryptographic Key Management Systems, NIST Special Publication 800-152, National Institute of Standards and Technology, Gaithersburg, MD. Google Scholar
Brickell, E., and J. Li, 2012, Enhanced Privacy ID: A Direct Anonymous Attestation Scheme with Enhanced Revocation Capabilities, IEEE Transactions on Dependable and Secure Computing, 9(3), 345–360. Crossref, Google Scholar
Buterin, V., 2014, Ethereum: A Next-Generation Cryptocurrency and Decentralized Application Platform, Bitcoin Magazine, January, available at: https://bitcoinmagazine.com/articles/ethereum-next-generation-cryptocurrency-decentralized-application-platform-1390528211/. Google Scholar
CableLabs, 2019, CableLabs New PKI Certificate Policy: Version 2.1, Technical Specifications, January, available at: https://www.cablelabs.com/resources/digital-certificate-issuance-service. Google Scholar
Camenisch, J., and A. Lysyanskaya, 2002, A Signature Scheme with Efficient Protocols, in S. Cimato, G. Persiano and C. Galdi (editors), Security in Communication Networks (SCN2002), Lecture Notes in Computer Science, Vol. 2576, Springer, Berlin, 2002, pp. 268–289. Google Scholar
Camenisch, J., and E. Van Herreweghen, 2002, Design and Implementation of the Idemix Anonymous Credential System, in Proceedings of the 9th ACM Conference on Computer and Communications Security, ACM, New York, pp. 21–30. Crossref, Google Scholar
Chavez-Dreyfuss, G., 2018, Cryptocurrency Theft Hits Nearly $1 Billion in First Nine Months, Reuters Business News, October 10, available at: https://www.reuters.com/article/us-crypto-currency-crime/cryptocurrency-theft-hits-nearly-1-billion-in-first-nine-months-report-idUSKCN1MK1J2. Google Scholar
Chokhani, S., W. Ford, R. Sabett, C. Merrill, and S. Wu, 2003, Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework, IETF Standard RFC3647, November, available at: http://tools.ietf.org/rfc/rfc3647.txt. Google Scholar
Committee on National Security Systems (CNSS), 2009, Instructions for National Security Systems Public Key Infrastructure X.509 Certificate Policy: Under CNSS Policy No. 25, CNSS Instruction No. 1300, October, available at: https://www.hsdl.org. Google Scholar
Cooper, D., S. Santesson, S. Farrell, S. Boeyen, R. Housley, and W. Polk, 2008, Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, IETF Standard RFC5280, May, available at: http://tools.ietf.org/rfc/rfc5280.txt. Google Scholar
FATF, 2018, International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation, FATF Revision of Recommendation, 15 October, FATF Secretariat, Paris, France, available at: http://www.fatf-gafi.org/publications/fatfrecommendations/documents/fatf-recommendations.html. Google Scholar
Financial Action Task Force (FATF), 2019a, Who We Are, available at: http://www.fatf-gafi.org. Google Scholar
Farrell, S. and R. Housley, 2002, An Internet Attribute Certificate Profile for Authorization, IETF Standard RFC3281, April, available at: http://tools.ietf.org/rfc/rfc3281.txt. Google Scholar
FATF, 2019b, Guidance for a Risk-Based Approach: Virtual Assets and Virtual Asset Service Providers, FATF Guidance, June, FATF Secretariat, Paris, France, available at: www.fatf-gafi.org/publications/fatfrecommendations/documents/guidance-RBA-virtual-assets.html. Google Scholar
Finextra, 2004, Swift to introduce PKI security for FIN, Finextra News, October, available at: https://www.finextra.com/newsarticle/12620/swift-to-introduce-pki-security-for-fin. Google Scholar
Gemalto, Inc., 2008, LINQUS USIM 128K Smartcard — ESIGN PKI Signature Application, Product Specifications, available at: https://www.commoncriteriaportal.org/files/epfiles/cible2008_37en.pdf. Google Scholar
Gray, J., and L. Lamport, 2006, Consensus on Transaction Commit, ACM Transactions on Database Systems, 31(1), 133–160. Crossref, Google Scholar
Gutmann, P., 2006, Internet X.509 Public Key Infrastructure Operational Protocols: Certificate Store Access via HTTP, IETF Standard RFC4387, February, available at: http://tools.ietf.org/rfc/rfc4387.txt. Google Scholar
Hardjono, T., 2008, Strengthening Enterprise Applications Using Trusted Platform Modules, Network Security, 2008(6), 15–18. Google Scholar
Hardjono, T., A. Lipton, and A. Pentland, 2019, Towards an Interoperability Architecture Blockchain Autonomous Systems, IEEE Transactions on Engineering Management, https://doi.org/10.1109/TEM.2019.2920154. Google Scholar
Hardjono, T., and A. Pentland, 2016, Verifiable Anonymous Identities and Access Control in Permissioned Blockchains, Technical Report, MIT Connection Science & Engineering, April, available at: https://arxiv.org/abs/1903.04584. Google Scholar
Housley, R., W. Ford, W. Polk, and D. Solo, 1999, Internet X.509 Public Key Infrastructure Certificate and CRL Profile, IETF Standard RFC2459, January, available at: http://tools.ietf.org/rfc/rfc2459.txt. Google Scholar
Housley, R., and T. Polk, 2001, Planning for PKI: Best Practices for PKI Deployment, John Wiley & Sons, New York. Google Scholar
ISO, 2017, ISO/IEC 9594-8:2017: Information Technology — Open Systems Interconnection — The Directory — Part 8: Public-Key and Attribute Certificate Frameworks, Standard, February, International Organization for Standardization, Geneva, Switzerland. Google Scholar
Kuhn, D. R., V. C. Hu, W. T. Polk, and S.-J. Chang, 2001, Introduction to Public Key Technology and the Federal PKI Infrastructure, NIST Special Publication 800-32, February, National Institute of Standards and Technology, available at: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-32.pdf. Google Scholar
Lipton, A., T. Hardjono, and A. Pentland, 2018, Digital Trade Coin (DTC): Towards a More Stable Digital Currency, Journal of the Royal Society Open Science, 5(7), 180155. Crossref, Google Scholar
Makaay, E., T. Smedinghoff, and D. Thibeau, 2017, OpenID Exchange: Trust Frameworks for Identity Systems, June, available at: http://www.openidentityexchange.org. Google Scholar
Microsoft, 2017, TPM Key Attestation, Microsoft IT Pro Center Report, May, available at: https://docs.microsoft.com/en-us/windows-server/identity/adds/manage/component-updates/tpm-key-attestation. Google Scholar
Microsoft, 2018, Microsoft X.509 Public Key Certificates, May, available at: https://docs.microsoft.com/en-us/windows/win32/seccertenroll/about-x-509-public-key-certificates. Google Scholar
Myers, M., R. Ankney, A. Malpani, S. Galperin, and C. Adams, 1999, X.509 Internet Public Key Infrastructure Online Certificate Status Protocol — OCSP, IETF Standard RFC2560, June, available at: http://tools.ietf.org/rfc/rfc2560.txt. Google Scholar
Nakamoto, S., 2008, Bitcoin: A Peer-to-Peer Electronic Cash System, available at https://bitcoin.org/bitcoin.pdf. Google Scholar
National Automated Clearing House Association (NACHA), 2019, Operating Rules and Guidelines, Specification, available at: https://www.nacha.org. Google Scholar
OASIS, 2005, Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0, March, available at: http://docs.oasisopen.org/security/saml/v2.0/saml-core-2.0-os.pdf. Google Scholar
Peyton, A., 2018, Singapore Regulator Gives Customer Onboarding Guidance, Fintech Futures, 8 February, available at: https://www.fintechfutures.com/2018/02/singapore-regulator-gives-customer-onboarding-guidance/. Google Scholar
Rivest, R., A. Shamir, and L. Adleman, 1978, A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, Communication of the ACM, 21(2), 120–126. Crossref, Google Scholar
Sakimura, N., J. Bradley, M. Jones, B. de Medeiros, and C. Mortimore, 2014, OpenID Connect Core 1.0, Technical Specification v1.0 — Errata Set 1, November, OpenID Foundation, available at: http://openid.net/specs/openid-connect-core-1_0.html. Google Scholar
Santesson, S., M. Myers, R. Ankney, A. Malpani, S. Galperin, and C. Adams, 2013, X.509 Internet Public Key Infrastructure Online Certificate Status Protocol OCSP, IETF Standard RFC6960, June, available at: http://tools.ietf.org/rfc/rfc6960.txt. Google Scholar
Sporny, M., D. Longley, and D. Chadwick, 2019, Verifiable Credentials Data Model 1.0, W3C Candidate Recommendation, March, W3C, available at: https://www.w3.org/TR/verifiable-claims-data-model. Google Scholar
SWIFT, 2017, SWIFT Qualified Certificates for Electronic Seals, Certification Practice Statement, October, available at: https://www.swift.com/pkirepository. Google Scholar
Symantec, 2013, Symantec Shared Service Provider Certification Practice Statement, Certificate Practices Statement Version 1.14, April, available at: https://www.symantec.com/content/en/us/about/media/repository/ssp-cps.pdf. Google Scholar
Trustis, 2017, Open Banking Certificate Policy, Version 1.0 (T-0328-001-GH-001), available at: http://ob.trustis.com/production/policies/. Google Scholar
Visa, 2013, Visa International Operating Regulations, Specification, October, available at: https://usa.visa.com/dam/VCOM/download/merchants/visa-international-operating-regulations-main.pdf. Google Scholar
United States Congress, 2000, Electronic Signatures in Global and National Commerce Act (ESIGN), Public Law 106–229, available at: http://govinfo.gov/content/pkg/PLAW-106publ229/pdf/PLAW-106publ229.pdf. Google Scholar