Subject: [KEYPROV] Comparison of key policy between PSKC and SKSML

From: "Philip Hoyer" <[email-masked]>
Date: Tue, 10 Feb 2009 12:36:08 +0100

Ladies and Gentlemen,

As you remember I took an action to provide an analysis on the
comparison between the key policy in PSKC and SKSML.

Please note that our concept of Policy maps more directly to the concept
of Permissions in SKSML Hence the comparison is between PSKC.KeyPolicy
and SKSML Permissions/

I would love to discuss this on today's call so it would be great if you
have a read through and form an opinion of which parts that are present
in SKSML we should add to PSKC if any.

For me the following make sense:

1.	Applications
2.	NumberOfTransactions
3.	Location (not sure here though how it is modelled)
4.	Status of a key potentially but again not sure what the meaning
is....

Comparison:

Element

PSKC - KeyPolicy

SKSML - Permissions

Notes

StartDate

Y

PermittedDays

SKSML allows a list of permitted dates each have start and end

ExpiryDate

Y

PermittedDays

PINPolicy

Y

N

KeyUsage

Y

PermittedUses

PSKC defines values whereas SKSML does not but allows 'any'

Applications

N

Y

  A list of applications that are permitted to use this key.  The
interpretation of the application 

element is user application-defined.  It may consist  of a name, version
number, a message digest, etc.

Days

N

Y

A list of days of the week that the symmetric key may be used.  Its
meaning is application-specific

Duration

Can be modelled with ExpiryDate as it models UTC up to milliseconds

Y

The number of seconds a symmetric key may be used for, once the client
application starts using the key.

Levels

N

Y

A list of classification levels within which an application is permitted
to use the key.  Its  interpretation is application-specific.

Location

N

Y contains sub elements of:

<locationName>

And list of Coordinates (Latitude Longitude)

NumberOfTransactions

N

Y

Times

N

Y

List of Start and end times during a 24 hour period that the key can be
used

Additionally it is worth mentioning the following differences:

SKSML allows the naming of a KeyPolicy this is where SKSML transmits
AlgorithmsType and permissions.

SKSML seems to allows the transmission of a status of a key.

SKSML has the concept of keyCaches ....

Philip

________________________________

Philip Hoyer 

Senior Architect - Office of CTO

ActivIdentity (UK)

117 Waterloo Road

London SE1 8UL

Telephone: +44 (0) 20 7960 0220

Fax: +44 (0) 20 7902 1985

Private and confidential: This message and any attachments may contain

privileged / confidential information. If you are not an intended
recipient,

you must not copy, distribute, discuss or take any action in reliance on
it.

If you have received this communication in error, please notify the
sender

and delete this message immediately.