Certco (financial services)
Encyclopedia
CertCo was a financial
cryptography
startup
spun out of Bankers Trust
in the 1990s. It had offices in New York City
and Cambridge
, Massachusetts
. It offered three main public key infrastructure
(PKI
) based products: an Identity Warranty system (tracking and insuring reliance on identity assertions in financial transactions); an electronic payment system (internally known as Acquire); and an Online Certificate Status Protocol
(OCSP) responder for validating X.509
public key certificate
s.
.
Some of its better known early employees included Rich Ankney, Ed Appel, Alan Asay, Ernest Brickell, David Kravitz (inventor of the Digital Signature Algorithm
), Yair Frankel, Dan Geer
, C.T. Montgomery, Jay Simmons, Nanette Di Tosto, and Moti Yung.
Early on it licensed the "Fair Cryptosystem" key escrow
patents of MIT Professor Silvio Micali
and announced plans to implement a "Commercial Key Escrow System" (mentioned in http://www.cosc.georgetown.edu/~denning/crypto/Taxonomy.html). Thereafter the policy climate for key escrow
turned negative http://www.cdt.org/crypto/risks98/, market interest waned, and the system was never built.
CertCo and Bankers Trust
promoted the creation of a bank consortium to serve as a PKI certificate authority
for global commerce, leading to the 1999 launch of Identrus, later renamed Identrust
. The banks, however, declined to license CertCo's technology, opting instead for a vendor-neutral approach.
CertCo's most notable commercial customer was SETCo http://findarticles.com/p/articles/mi_m0NEW/is_1997_May_13/ai_19401029, the operating company for the Visa-Mastercard
Secure electronic transaction
credit card security protocol, to which it provided certificate authority
technology.
and public key infrastructure
. Its most heavily-cited patents by subject are:
Attribute Certificates Certificate Authority
Digital Rights Management
Identity Warranty Key escrow
Payment System
Other patent filings include Changing key fragments in a digital signature system
Ad hoc management of credentials, trust relationships and trust history
for its products, and went out of business in Spring 2002, following substantial reductions in technical staff in November and December 2001.
Near the end of its life, CertCo briefly achieved public notoriety by suing PayPal
http://news.com.com/2100-1017-830235.html for patent infringement, delaying the latter's highly anticipated IPO. The dispute was reportedly settled for a nominal amount http://news.com.com/2110-1017_3-894672.html.
Finance
"Finance" is often defined simply as the management of money or “funds” management Modern finance, however, is a family of business activity that includes the origination, marketing, and management of cash and money surrogates through a variety of capital accounts, instruments, and markets created...
cryptography
Cryptography
Cryptography is the practice and study of techniques for secure communication in the presence of third parties...
startup
Startup company
A startup company or startup is a company with a limited operating history. These companies, generally newly created, are in a phase of development and research for markets...
spun out of Bankers Trust
Bankers Trust
Bankers Trust was an historic American banking organization. The bank merged with Alex. Brown & Sons before being acquired by Deutsche Bank in 1998.-History:A consortium of banks created Bankers Trust to perform trust company services for their clients....
in the 1990s. It had offices in New York City
New York City
New York is the most populous city in the United States and the center of the New York Metropolitan Area, one of the most populous metropolitan areas in the world. New York exerts a significant impact upon global commerce, finance, media, art, fashion, research, technology, education, and...
and Cambridge
Cambridge, Massachusetts
Cambridge is a city in Middlesex County, Massachusetts, United States, in the Greater Boston area. It was named in honor of the University of Cambridge in England, an important center of the Puritan theology embraced by the town's founders. Cambridge is home to two of the world's most prominent...
, Massachusetts
Massachusetts
The Commonwealth of Massachusetts is a state in the New England region of the northeastern United States of America. It is bordered by Rhode Island and Connecticut to the south, New York to the west, and Vermont and New Hampshire to the north; at its east lies the Atlantic Ocean. As of the 2010...
. It offered three main public key infrastructure
Public key infrastructure
Public Key Infrastructure is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate...
(PKI
PKI
PKI can refer to any of several things:* Kings Island, an amusement park formerly known as Paramount's Kings Island.* Partai Komunis Indonesia...
) based products: an Identity Warranty system (tracking and insuring reliance on identity assertions in financial transactions); an electronic payment system (internally known as Acquire); and an Online Certificate Status Protocol
Online Certificate Status Protocol
The Online Certificate Status Protocol is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate. It is described in RFC 2560 and is on the Internet standards track...
(OCSP) responder for validating X.509
X.509
In cryptography, X.509 is an ITU-T standard for a public key infrastructure and Privilege Management Infrastructure . X.509 specifies, amongst other things, standard formats for public key certificates, certificate revocation lists, attribute certificates, and a certification path validation...
public key certificate
Public key certificate
In cryptography, a public key certificate is an electronic document which uses a digital signature to bind a public key with an identity — information such as the name of a person or an organization, their address, and so forth...
s.
Early history
CertCo was founded in March 1994 by Frank Sudia and Peter Freund as an internal bank department known as BT Electronic Commerce (BTEC). It spun out in November 1996 as CertCo with a number of outside strategic and financial investors in a transaction managed by Goldman SachsGoldman Sachs
The Goldman Sachs Group, Inc. is an American multinational bulge bracket investment banking and securities firm that engages in global investment banking, securities, investment management, and other financial services primarily with institutional clients...
.
Some of its better known early employees included Rich Ankney, Ed Appel, Alan Asay, Ernest Brickell, David Kravitz (inventor of the Digital Signature Algorithm
Digital Signature Algorithm
The Digital Signature Algorithm is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology in August 1991 for use in their Digital Signature Standard , specified in FIPS 186, adopted in 1993. A minor...
), Yair Frankel, Dan Geer
Dan Geer
Dan Geer is a computer security analyst and risk management specialist. He is recognized for raising awareness of critical computer and network security issues before the risks were widely understood, and for ground-breaking work on the economics of security....
, C.T. Montgomery, Jay Simmons, Nanette Di Tosto, and Moti Yung.
Early on it licensed the "Fair Cryptosystem" key escrow
Key escrow
Key escrow is an arrangement in which the keys needed to decrypt encrypted data are held in escrow so that, under certain circumstances, an authorized third party may gain access to those keys...
patents of MIT Professor Silvio Micali
Silvio Micali
Silvio Micali is an Italian-born computer scientist at MIT Computer Science and Artificial Intelligence Laboratory and a professor of computer science in MIT's Department of Electrical Engineering and Computer Science since 1983. His research centers on the theory of cryptography and information...
and announced plans to implement a "Commercial Key Escrow System" (mentioned in http://www.cosc.georgetown.edu/~denning/crypto/Taxonomy.html). Thereafter the policy climate for key escrow
Key escrow
Key escrow is an arrangement in which the keys needed to decrypt encrypted data are held in escrow so that, under certain circumstances, an authorized third party may gain access to those keys...
turned negative http://www.cdt.org/crypto/risks98/, market interest waned, and the system was never built.
CertCo and Bankers Trust
Bankers Trust
Bankers Trust was an historic American banking organization. The bank merged with Alex. Brown & Sons before being acquired by Deutsche Bank in 1998.-History:A consortium of banks created Bankers Trust to perform trust company services for their clients....
promoted the creation of a bank consortium to serve as a PKI certificate authority
Certificate authority
In cryptography, a certificate authority, or certification authority, is an entity that issues digital certificates. The digital certificate certifies the ownership of a public key by the named subject of the certificate...
for global commerce, leading to the 1999 launch of Identrus, later renamed Identrust
Identrust
IdenTrust is a bank consortium acting as a public key certificate authority and secure applications provider whose members include over 60 of the largest banks in the world....
. The banks, however, declined to license CertCo's technology, opting instead for a vendor-neutral approach.
CertCo's most notable commercial customer was SETCo http://findarticles.com/p/articles/mi_m0NEW/is_1997_May_13/ai_19401029, the operating company for the Visa-Mastercard
MasterCard
Mastercard Incorporated or MasterCard Worldwide is an American multinational financial services corporation with its headquarters in the MasterCard International Global Headquarters, Purchase, Harrison, New York, United States...
Secure electronic transaction
Secure electronic transaction
Secure Electronic Transaction was a standard protocol for securing credit card transactions over insecure networks, specifically, the Internet. SET was not itself a payment system, but rather a set of security protocols and formats that enable users to employ the existing credit card payment...
credit card security protocol, to which it provided certificate authority
Certificate authority
In cryptography, a certificate authority, or certification authority, is an entity that issues digital certificates. The digital certificate certifies the ownership of a public key by the named subject of the certificate...
technology.
Technical Contributions
CertCo made various contributions to the fields of cryptographyCryptography
Cryptography is the practice and study of techniques for secure communication in the presence of third parties...
and public key infrastructure
Public key infrastructure
Public Key Infrastructure is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. In cryptography, a PKI is an arrangement that binds public keys with respective user identities by means of a certificate...
. Its most heavily-cited patents by subject are:
Attribute Certificates Certificate Authority
Certificate authority
In cryptography, a certificate authority, or certification authority, is an entity that issues digital certificates. The digital certificate certifies the ownership of a public key by the named subject of the certificate...
Digital Rights Management
Digital rights management
Digital rights management is a class of access control technologies that are used by hardware manufacturers, publishers, copyright holders and individuals with the intent to limit the use of digital content and devices after sale. DRM is any technology that inhibits uses of digital content that...
Identity Warranty Key escrow
Key escrow
Key escrow is an arrangement in which the keys needed to decrypt encrypted data are held in escrow so that, under certain circumstances, an authorized third party may gain access to those keys...
Payment System
Other patent filings include Changing key fragments in a digital signature system
Ad hoc management of credentials, trust relationships and trust history
Standards & Policy
CertCo personnel contributed to a number of standards bodies and policy projects, including:- IETF Online Certificate Status ProtocolOnline Certificate Status ProtocolThe Online Certificate Status Protocol is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate. It is described in RFC 2560 and is on the Internet standards track...
OCSP - American Bar AssociationAmerican Bar AssociationThe American Bar Association , founded August 21, 1878, is a voluntary bar association of lawyers and law students, which is not specific to any jurisdiction in the United States. The ABA's most important stated activities are the setting of academic standards for law schools, and the formulation...
Digital Signature Guidelines - ANSIAnsiAnsi is a village in Kaarma Parish, Saare County, on the island of Saaremaa, Estonia....
X9.30 The Digital Signature Algorithm (DSA) - ANSIAnsiAnsi is a village in Kaarma Parish, Saare County, on the island of Saaremaa, Estonia....
X9.31 Reversible Public Key Cryptography (rDSA) (better known as RSA) - ANSIAnsiAnsi is a village in Kaarma Parish, Saare County, on the island of Saaremaa, Estonia....
X9.45 Attribute Certificates - ANSIAnsiAnsi is a village in Kaarma Parish, Saare County, on the island of Saaremaa, Estonia....
X9.57 Certificate Management for Financial Services
Endgame
CertCo used up all of its money, never found a wide marketMarket
A market is one of many varieties of systems, institutions, procedures, social relations and infrastructures whereby parties engage in exchange. While parties may exchange goods and services by barter, most markets rely on sellers offering their goods or services in exchange for money from buyers...
for its products, and went out of business in Spring 2002, following substantial reductions in technical staff in November and December 2001.
Near the end of its life, CertCo briefly achieved public notoriety by suing PayPal
PayPal
PayPal is an American-based global e-commerce business allowing payments and money transfers to be made through the Internet. Online money transfers serve as electronic alternatives to paying with traditional paper methods, such as checks and money orders....
http://news.com.com/2100-1017-830235.html for patent infringement, delaying the latter's highly anticipated IPO. The dispute was reportedly settled for a nominal amount http://news.com.com/2110-1017_3-894672.html.