Subject: RE: XKMS

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 30 Nov 2001 10:20:11 -0800

XKMS makes no distinction, but an XKMS service provider may choose to do so.

> The only problem is the matter of transitive trust, since 
> when transposing
> one protocol into another, all the security (in particular the digital
> signature) is lost at the gateway.

That is not the case at all. There is a change in the security parameters,
but to claim that the change in the signing party means that 'all the
security'
is lost is untrue hyperbole. One aspect of the security context is
discarded,
that does not mean it is 'lost'.

If you want the cert chain, XKMS does allow you to request it.

		Phill

Phillip Hallam-Baker FBCS C.Eng.
Principal Scientist
VeriSign Inc.
[email-masked]
781 245 6996 x227