David,
If you take a look on the link I
supplied
( http://www.x-obi.com/OBI400/draft-rundgren-pkix-pnppki4ws-00.pdf )
it should give some indications of one area that I
feel does not work to well.
A powerpoint is also available:
http://www.x-obi.com/OBI400/PnPPKI4WS.ppt
I.e. it is really Web Services that are addressed
as this is what most people believe is where both PKI and e-business will be in
a relatively short period. Below is an extract from another posting
highlighting some basic problems that the work is supposed to
address:
First it is important to note that digital
signatures are virtually non-existent in B2B so what follows here is
"theory". Digital signatures have a major problem which did not
exist in the paper-world. A signature on paper is a
technically imprecise way of giving "authenticy" to a
document. A digital signature on the other hand identifies the signer
in a technically very strong way. Now, lets say that you have an
invoice from ACME Corp (using any of the rather arbitrary ways to identify
this), what is the stronger part of the identity (i.e. the certificate) supposed
to contain? And even worse, if you use personal signatures what should
these contain? John Doe at ACME Corp? Are business systems supposed
to cross-check between the claimed identity in the business document and the
certificate? I believe so, but here there is mostly zero interoperability
and hardly any normative documents to find. Consortiums like ebXML don't
touch such issues and PKI folks typically shun business systems like the
plague. In case anybody of this list is interested in this area (maybe
even co-authoring), I'm currently toiling with an IETF draft (enclosed), trying
to "marry" PKI and business systems. It is worth noting that the
e-Government in Sweden have (in their actual systems), not yet addressed
the idea that a citizen of an other EU-country would use their certificate,
which by the way is rather hard as there is no universal way to express personal
identities either. The qualified certificate standard does not require
globally unique identities so you could even end-up with name conflicts!
PKI is unfortunately an immature technology originally designed for sending
e-mail between individuals which is rather different to sending messages between
or to "machines" as the latter only "compute" which is not equivalent to humans'
"understand".
Best
Anders R
----- Original Message -----
From: "David Sweigert" <>
To: "Anders Rundgren" <>;
<>
Sent: Thursday, February 27, 2003
17:08
Subject: Re: [pki-tc] PKI/e-business IETF draft
co-editor
A short note:
It sounds like you
are seeking standards on the process of web-access
control
an
dauthentication. Can you please define "e-Business" systems in a
more
clear manner ?
David Sweigert, CISSP
----- Original
Message -----
From: "Anders Rundgren" <>
To:
<>
Sent: Thursday, February 27, 2003 10:25 AM
Subject: [pki-tc]
PKI/e-business IETF draft co-editor
> Dear List
members,
>
> PKI/e-business IETF draft co-editor
>
-----------------------------------------
> I am trying to find somebody
else who have also worked with combining
> e-business systems with
PKI. This is currently an unusual combination in
> spite of all that
we have heard about the value of digital signatures.
Due to
> this
fact, there is an immanent need for addressing this, and in my
opinion
also
> a need to create one or more Internet Drafts. However,
in applicable
standard-
> groups like IETF's PKI Working Group, PKIX,
there is to my knowledge
hardly
> any persons with suitable backgrounds
for such a task. Therefore I am
looking
> in other places
for a co-editor, or at least somebody to try new ideas
on
:-).
>
>
===========================================================
> In case you
or somebody you know of, could be suitable, please contact me
ASAP!
>
===========================================================
>
>
These are the approximative "requirements":
>
> - Knowledge of
business systems architectures and technologies
> like Web,
SQL and XML
>
> - Basic knowledge of PKI
>
> - An
genuine interest in user- and deployment-related questions
>
> -
Basic capability of reading technical standards documents
>
> Note:
This effort is mostly technical but if there is somebody out
> there with
an interest in CA business models and liability, this
> is also of
interest!
>
> This is an initial effort to study:
> http://www.x-obi.com/OBI400/draft-rundgren-pkix-pnppki4ws-00.pdf
>
> Unfortunately you don't get paid by IETF, the
best you can hope for
> is that a draft is approved...
>
> In
case the OASIS PKI-TC is interested, this could be turned into
> an OASIS
effort.
>
> Best Regards
> Anders Rundgren
> Senior
Internet e-Commerce Architect
> +46 70 - 627 74
37
>
>
