Application SC report - March 2005

[Arshad Noor <arshad.noor@strongauth.com>]

The following activities have occurred within the Applications
Guidelines SC since the last TC meeting in January 2005:

1) I have spoken to many people about the "Transaction-PKI" effort
    and have found a fair amount of interest in the effort.  Some
    people are waiting for a formal definition of the scope before
    deciding whether to join OASIS and participate in the effort;

2) I have been doing research on the subject and have discovered
    that there are a number of standards that have been defined in
    the XML arena (XMLSignature and XMLEncryption, for instance)
    and there are open-source (Apache, XMLSec) and commercial
    implementations of these standards.  However, what is not yet
    obvious is what's missing from making these tools easy to use
    to digitally sign and encrypt atomic transactions.  Secondly,
    it is not clear (at least to me) what the overlap is between
    XMLSignature and the OASIS Digital Signature Services effort
    (anyone who is a participant in the DSS forum, and who has
    an understanding of the overlap/differences, please contact
    me - thanks).  Research continues in this arena;

3) A meeting was held within the SC to refine the scope of this
    effort. Steve Hanna wanted to be sure that the effort focused
    on activities that would solve real customer problems and not
    just explore something that might be interesting.   Based on
    feedback from Catherine Li (a non-vendor participant), it
    appears that focusing on this capability for the web
    environment (browser to application server, for instance) is
    the appropriate scope for the first phase of this effort.  If
    there are other non-vendor PKI-TC members who would like to
    provide some feedback, that will be appreciated;

In the next month, it is hoped that some of the murky technical
questions will get clearer, thus sharpending the focus on what
this project will deliver.

Arshad Noor
StrongAuth, Inc.