Subject: RE: Another DPV/DPD challenger

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 19 Nov 2002 10:14:27 -0800

No, DSS does not perform validation, it does the opposite, it creates
signatures.

XKMS does delegated validation and location. It is approaching last call
in W3C.

	Phill

> -----Original Message-----
> From: Anders Rundgren [mailto:[email-masked]]
> Sent: Monday, November 18, 2002 12:29 PM
> To: Peter Sylvester; [email-masked]; [email-masked]
> Subject: DSS: Another DPV/DPD challenger
> 
> 
> 
> Another contender from another "club".
> 
> http://www.oasis-open.org/committees/dss/
> 
> If I understand the minimal description correctly, DSS seems like
> a more logical next step than DPV/DPD as it addresses the
> current situation where information systems do not understand
> PKI at all.
> 
> cheers,
> Anders
> 
> ----- Original Message ----- 
> From: "Peter Sylvester" <[email-masked]>
> To: <[email-masked]>; <[email-masked]>
> Sent: Monday, November 18, 2002 15:48
> Subject: Re: draft agenda for PKIX
> 
> 
> 
> 
> hello,
> 
> tim polk reminded me that there is at least a fourth candidate
> for the DPV/DPD solution, i.e., using RFC 3029 for DPV and DPD.
> Since I am not able to present this at Atlanta, I'll do it
> here, and would be happy to hear/read comments. 
> 
> here it goes:
> 
> DVCS, i.e., RFC 3029 has proposed from its very beginning a
> framework allowing validation of public key certificates
> in combination with its other services.
> 
> Among others the goals are to provide thin client support
> and centralised management of certificate validity status.
> Furthermore, in a larger view, essentially by using relaying
> techniques, it is possible to implement a security infrastructure
> accompagning a application work flow that used certificates.
> 
> The results of a DVCS service can be authenticated in two
> ways depending on the needs of an application. Either, any
> transport security mechanism allowing immediate authentication
> betwwen a client server, and/or some mechanism to allow
> long term validation of the result. The security mechnisms
> are orthogonal to the asserted payload. For long term
> authentication, a combination of offline methods and
> online services are defined, i.e., a service should
> provide an online validation service for its own (or
> some else's) data validation certificates. 
> 
> The current text describes how to transport requests and
> responses above HTTP(S), and email. 
> 
> The client has the possiblity to provide additional
> information about certificate paths to the server. This
> interpretation of this information, and the way how
> the service is provided can be influenced by a policy
> indication. 
> 
> DVCS responses can return combined information, i.e.,
> assertions of validity combined with external time stamps.
> 
> As you might know, there is an ongoing open source
> implementation project for RFC 3029 and 3161 financed
> by the European Commission. As part of this, an
> update to correct some bugs in 3029 and to describe
> more usage scenarios, profiles is planned for
> begging next of year.  
> 
> For the rest you may read RFC 3029. 
> 
> Well, this is my 5 minutes presentation. :-)
> Regards and have fun.
> Peter Sylvester
> 
> 
> 
> 
>

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 19 Nov 2002 19:20:18 +0100

Phill,
From the OASIS home-page:

The OASIS Digital Signature Services Technical Committee
will develop techniques to support the processing of digital
signatures. This includes defining an interface for requesting
that a web service produce and/or verify a digital signature
on a given piece of data and techniques for proving that a
signature was created within its private key validity period.

To me it sounds like DSS "does it all" w.r.t. signatures.

/anders

----- Original Message -----
From: "Hallam-Baker, Phillip" <[email-masked]>
To: "Anders Rundgren" <[email-masked]>; "Peter Sylvester" <[email-masked]>; <[email-masked]>;
<[email-masked]>
Sent: Tuesday, November 19, 2002 19:14
Subject: RE: Another DPV/DPD challenger

Phill