RE: [dss] FW: DSS TC XKMS Last Call Comments

Title: DSS TC XKMS Last Call Comments

I propose the following response to the message 
XKMS:

 

 

Blair,

 

Apologies for the delay in responding to your 
message.

 

We agree with your suggestion and believe that <UseKeyWith> meets our 
requirements.

 

Nick Pope

Co-Chair OASIS DSS TC

  
 

  
-----Original Message-----
From: Blair Dillaway 
  [mailto:]
Sent: 02 August 2003 
  01:16
To: Robert Zuccherato
Cc: ; 
  
Subject: DSS TC XKMS Last Call 
  Comments

  
DSS TC: 

  
The DSS TC raised the issue of how one should 
  indicate to an XKMS client that key information returned by an XKMS service 
  was associated with a DSS service.  This would indicate that the keys are 
  in possession of the DSS service and associated with the DSS client through a 
  signed attribute.  It was suggested that a new <KeyUsage> element 
  value or a <UseKeyWith> URI might be appropriate.

  
We do not believe a new <KeyUsage> element 
  value is the correct mechanism for addressing this issue.  KeyUsage is 
  intended to identify the cryptographic operation that a key may be used 
  for.  It is not intended to indicate other factors such as how a key is 
  stored or who has control over the key's use.  Within the DSS context, 
  the appropriate KeyUsage would be "Signature".

  
We recommend definition of a new <UseKeyWith> 
  URI as the appropriate mechanism for meeting your requirements.  The XKMS 
  specification (23 July 2003 Editor's Draft), defines UseKeyWith as:

  
"[184] The primary use intended for 
  <UseKeyWith> identifiers is to identify application protocols. 
  <UseKeyWith> URI identifiers MAY be specified that represent key binding 
  issuance and/or use policies instead of or in addition to an application 
  protocol. In this case the <UseKeyWith> element specifies that the key 
  binding complies with the specified policy."

  
As we understand the objectives of the DSS TC, you 
  are defining a use policy for a signing key.  That use policy is along 
  the lines of:  signature generation is performed by an authorized DSS 
  server and is bound to a given client via a signed attribute.  Once the 
  DSS TC has formalized this policy statement, a URI may be associated with 
  it.  The DSS TC should define this URI and incorporate it into the DSS 
  specification.  The DSS effort is not at the appropriate standards status 
  level for a normative reference from within the XKMS specification. 

  
The XKMS WG would like to thank you for reviewing 
  and commenting on the draft XKMS specification.  We believe this 
  addresses your comments to the best of our ability and assume the issue is 
  closed unless we hear otherwise.

  
Regards, 
Blair 
  Dillaway on behalf of the XKMS WG