Subject: Re: Re: Last Call: 'Required functions of User Interface for the Internet X.509 Public Key Infrastructure' to Informational RFC

From: 박배효 <[email-masked]>
Date: Fri, 8 Jul 2005 19:11:15 +0900

Dear David Hopwood

This is BaeHyo Park, one of co-authors of draft-choi-pkix-ui-03. 

Most of all, thanks for your interests in this draft. I'd really appreciate
it. 

As you may agree, the main purpose of this draft is to make it sure that
there are many problems

on User Interface of PKI modules and software and to lead more discussions
for spreading better

PKI widely for users than now. However, from your comments, I think that
this draft needs to be

changed for representing this purpose. 

I'll give you my brief opinions on your comments. 

1. Inadequate motivation for "using one certificate [for] many PKI
applications" 

: It is from the idea that the client S/W of the applications should find
and display the users' certificates

without users' involvement. Of course, there can be more than one
certificate according to applications.

However, client S/Ws find and display all the certificates or some
certificates satisfied with application's

requirements, and then a user will select an appropriate certificate of
them.

2. Uncommon storage location of HARD DISK due to multi-user operating
systems and existing conventions

for where user certificates are stored 

: The issue related to HARD DISK will be totally changed because we didn't
give that much thought on OS

 even though the disk depends on OS. 

3. User software *cannot* validate the cert in a way that is guaranteed to
match the validation result of any relying party 

: Human users have the right to confirm that their certificates are valid
because there are many malicious attacks(Hacking)

on the certificates. (However, I don't think I understand your comment.
Could you please put more explanation on your advice?) 

4. Insecure method to update the PKI client software and the trust anchor's
certificate. 

  : In this text, "secure method" means the mechanism which guarantees the
integrity of PKI client S/W. 

In conclusion, I've got several opinions on this draft from PKI experts
including you.

We, authors, are willing to improve this draft with consideration of your
comments.

And also we hope to have more talks with you on user interface issues for
widespread

adoption of PKI in real world as well as standardizing this draft. 

I very much appreciate your review and thank you once again for sending it
to me. 

Best Regards 

BaeHyo Park