Subject: RE: IOTP Digital Signatures and authentication

From: David Burdett <[email-masked]>
Date: Thu, 25 Feb 1999 16:38:21 -0000

There is a need for authentication to make use of digital signatures.
Therefore I propose that we add a Algorithm elements to the AuthData
component. The AuthData component now looks like:

<!ELEMENT AuthData (PackagedContent+, Algorithm+)>
<!ATTLIST AuthData
 ID                 ID      #REQUIRED
 AuthenticationId   CDATA   #REQUIRED
 TradingRoleList    NMTOKEN #IMPLIED
 AlgorithmRefs      IDREFS  #REQUIRED
 ContentSoftwareId  CDATA   #IMPLIED >

The Algorithm element is the same element as is used in Digital
signatures. The AlgorithmRefs attribute lists the element references of
the Algorithms from which the recipient of the AuthData component can
make a selection to use when generating the response. This means that
the Authentication Response Component now looks like:

<!ELEMENT AuthResp (PackagedContent*) >
<!ATTLIST AuthResp
 ID                 ID      #REQUIRED
 SelectedAlgorithmRef NMTOKEN #REQUIRED
 ContentSoftwareId  CDATA   #IMPLIED >

The Selected AlgorithmRef now points to the Algorithm that was selected
by the receipient of the Authentication Request.

If the Algorithm is a standard one used when generating a Signature then
the result of the Authentication is a Signature Component and the
Packaged Content is omitted. Alternatively, if the authentication is
none-standard, for example using an authentication method associated
with a particular payment method, then there is no signature Component
in the response and instead the result is recorded in the Packagted
Content.

Thoughts?

David

>----------
>From: 	David Burdett
>Sent: 	24 February 1999 12:13
>To: 	'Ietf Trade WG'
>Subject: 	IOTP Digital Signatures - more changes
>
>Further to my last e-mail a couple of additional problems have been
>identified which I think need to be fixed:
>*	including a separate IOTP Signature Type element doesn't seem to make
>sens it is really just a particular mandatory attribute with a required
>value, so suggest removing IOTPSignatureType element and replacing by a
>normal "Attribute" element with a type attribute set to "IOTP
>SignatureType" and the content set to OfferResponse, PaymentResponse, or
>DeliveryResponse, Ping or AuthenticationResponse
>*	there is no explicit way of identifying which certificate should be
>used with a particular signature value. I therefore propose that we add
>to the RecipientInfo element another attribute called SignatureCertRef
>that identifies the Certificate Element that applies.
>
>David
>>Mondex International Limited
>mailto:<[email-masked]>
>>US Advanced Technology Office: 111 Pine St, 6th Floor, San Francisco, CA
>>94111
>Tel/Voicemail: +1 415 645 6973	Fax: +1 415 956 9370
>
>-----------------------------------------------------------------------
>Message addressed to: [email-masked]
>Archive available at: http://www.elistx.com/archives/ietf-trade/
>To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
>body to: [email-masked]
>
-----------------------------------------------------------------------
Message addressed to: [email-masked]
Archive available at: http://www.elistx.com/archives/ietf-trade/
To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
body to: [email-masked]