Subject: XKMS, Was RE: Software for PKI

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 21 Nov 2001 11:32:25 -0800

> Now I don't think that the folks working on XML-DSIG and XKMS are
> really doing it better. There's also the tendency to be most
> flexible by integrating as many PKI standards as possible. Same old
> problems...

I think you are misunderstanding what we are doing. XKMS is an 
interface to a PKI. It is not by itself a PKI.

Although it is quite possible to use XKMS in a network of peer-peer
real time responders without the support of a backing PKI the more
usual configuration would be as an interface to a PKI. In most cases
that PKI would be PKIX based.

The observations that the design of XKMS is based upon are:

1) Despite every effort, most developers hate, loathe and detest ASN.1
2) Client developers complain that PKIX is too complex to implement.
3) We continue to add to the PKIX specification.
4) Implementation suggests that inter-organizational trust justifies the
	complexity of PKIX.
5) XML based applications have a different risk profile to the email
	messaging applications that X.509 was originally intended to
	support.

The point is that we have come a long way in 10 years and there are
occasions when the thing to do is to attack a problem from a different
angle for a while. I find it very unhelpful for people to start
throwing arround the 'do you think you know better' question. 
Clearly the people who put that question think they know better
or they would not have asked it.

Anyway, the proposal to form an XKMS working group is currently 
before the W3C AC reps. The first face to face is planned for 8th 
December in Salt Lake city. It is an open meeting.

	Phill

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 22 Nov 2001 10:59:11 +0100

Phill,

I have XKMS Draft Version 1.1 draft 4. January 30 th, 2001.

Since the document advertises at a bottom of a page an amendment 
for a version 1.2, is there a more recent document available ?

Is there a document that explains in a few pages the philosophy 
besides XKMS in particular in terms of the trust model when 
multiple trust points are used (i.e. multiple self-signed certificates) ?

Here is a related question: Does XKMS make a difference between the name 
of an entity certified by CA1 and the same name certified by CA2 ?  

Thanks.

Denis

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 22 Nov 2001 11:48:51 +0000

Hi Denis,

XKMS is being discussed on the W3C XKMS workshop list [1]. 
Its probably not appropriate to get into the details of 
it on PKIX (previous XML related threads having been
painful;-)

Regards,
Stephen.

[1] http://lists.w3.org/Archives/Public/www-xkms-ws/

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:[email-masked]
Ireland                             http://www.baltimore.com