Backdoor government key escrow?

[Joe Harrison]

Recent measures in the Finance Bill propose large fines to "encourage"
people to file tax returns electronically (see
http://news.bbc.co.uk/hi/english/business/newsid_1975000/1975504.stm )

I find this worrying - already in the same model businesses may file VAT
returns electronically provided they first purchase an identifying client
certificate to allow them to login to the government's VAT system. The
acknowledged market-leading commercial CAs for personal certificate issuance
are companies like Verisign/Thawte BUT only certificates issued by a choice
of two little-known companies (Chambersign or Equifax) are acceptable for
VAT filing. (http://www.hmce.gov.uk/business/electronic/evr-getting.htm)

As it happens, these two are the only commercial certificate authorities in
existence who issue certificates by generating the private and public keys
on your behalf then handing you the entire thing as a fait-accompli. Usual
practice elsewhere is that you generate your own keypair and send only the
public key off to be signed.

So the end result in the VAT-returns case is that a copy of your private key
may or may not be kept by the CA or by HMCE, you do not know. If the PAYE
system were to develop along similar lines then a large fraction of the
population would hold a certificate with an unsafe private key.

It would not be a long step from there to encourage people to use that same
certificate routinely for a variety of other purposes, such as "secure"
e-mail...

Joe