Subject: Re: Need for TSTokens and who should own the effort, was Re: QC "Certificate Overloading"

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 9 May 1999 21:59:53 +0100

Todd,
Comments in line-

>Actually this thread subject, that of using x.509 certs to carry event
>tokens has more higher-level implications I think. What certs were intended
>for was identifying entities, not representing physical events or
>timestamping data elements.

I see nothing fundamentally wrong in using certificates for any kind of certifyable information.

>This is a very important issue and try to use a cert to carry event specific
>data, while it may be technically possible, may not have as many commercial
>uses as we would like to think it does, and this effect may be due to issues
>in law more than anything else.

Should I interprete this as: "Dynamic Certificates" as described by A.R. will be outlawed?

<snip>

>The only question to answer from my perspective, is whether PKIX and the
>IETF is the forum to use to standardize them and if not, then who is?

That is a good question.  Looking on things historically one can find that OBI and SET which will be the dominant PKI-systems in the hot e-commerce sector were developed by closed consortiums that have huge member-fees so if not the IETF acts now I would say it will very soon be too late.  Personally I don't care that much as I am determined to participate in whatever form such an effort will surface :-)

Anders Rundgren
http://www.mobilephones-tng.com