Subject: RE: dissemination of public encryption certificates

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 14 Aug 2003 11:16:47 -0700

> Leaving aside who supports what and why, don't understand the
> implied conflict between xkms and scvp.  They seem to do two 
> different things -- I want to find a cert for [email-masked]
> to send email to that entity; I have a cert from [email-masked] --
> what is it good for?  I didn't think SCVP would help much with
> the first, and I clearly don't see what XKMS would do with the
> second question.  Would like a better understanding of this.

Thats quite a good description of SCVP.

XKMS does not answer that question because I can't think of a situation
where is would be of interest. The certificate is simply a data object that
is created to establish the trustworthiness of a key. Applications don't ask
'what is this good for?', they ask 'how do I do this task?'.

		Phill

---

From: "Blake Ramsdell" <[email-masked]>
Date: Thu, 14 Aug 2003 14:42:48 -0700

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> Hallam-Baker, Phillip
> Sent: Thursday, August 14, 2003 11:17 AM
> To: [email-masked]'; Hallam-Baker, Phillip
> Cc: 'Steve Hole'; Julien Pierre; [email-masked]
> Subject: RE: dissemination of public encryption certificates 
> 

Well, I'm not sure I agree.  There are two major questions that
constantly need answers in the mind of an S/MIME client.  These are
pretty close to what Michael said in his message:

1. Given a particular email address, give me That Which Is Necessary and
Sufficient to send encrypted mail to that email address.

2. Given a particular certificate, is it suitable for signing mail that
came from a particular email address.  Michael said "what is it good
for", which I think is too broad a question.

If we're considering protocols that attempt to answer these types of
questions, those are the two questions that need to be answered by that
protocol (for interpersonal messaging with S/MIME, that is).

Blake

---

From: [email-masked] (Julien Pierre)
Date: Thu, 14 Aug 2003 20:05:04 -0700

Blake,

 > protocol (for interpersonal messaging with S/MIME, that is).

Yes. I believe this is relevant to the SMIME mailing list, even though 
the choice and design of that protocol may not affect the SMIME message 
format itself, as these are major deployment issues.

It would be highly desirable for one protocol to be designated for the 
purpose of solving these problems, as opposed to having a plethora of 
different solutions and having various client programs use different 
approaches, which would get us back to square one.

-- 
I am the dog in dogfood

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Thu, 14 Aug 2003 20:33:17 -0700

>approaches, which would get us back to square one.

We are already at that square.

>I believe this is relevant to the SMIME mailing list, even though

I'm not convinced that this WG is the best one for the discussion, 
inasmuch as it is not in our charter and the WG is supposed to wind 
down. On a related note, there may be a new WG starting up to discuss 
how to handle certificate management in IPsec (the IPsec WG has 
failed worse than S/MIME on certificate issues). It might be 
interesting to have a single WG that covers both issues.

--Paul Hoffman, Director
--Internet Mail Consortium