OpenDoc and OASIS PKI

[Arshad Noor <arshad.noor@strongauth.com>]

I just realized that as Chair of the Application Guidelines subcommitee,
it becomes my responsibility to encourage movements towards the use of
applications that use PKI effectively.

Given that, and since I will not be present in next week's TC meeting,
I would like to bring up a subject for discussion and vote:

Now that OASIS has standardized the OpenDoc format, and it has been
embraced and implemented by most technology vendors, including some US
states & EU countries, it behooves us (PKI-TC) to standardize all our
internal documents on the OpenDoc format.

As such, I propose that we convert all our archived documents to the
OpenDoc format, submit all future documentation only in the OpenDoc
format, and move the OASIS executive commitee to require the same from
all other OASIS TC's.

Furthermore, I would like to move that all OpenDoc documents should be
digitally signed to maintain their integrity and authenticity.   While
one can argue that there may be little benefit to an attacker modifying
OASIS standards documents, I believe the principle behind the process
is more important.  (As Scott McNealy was so fond of saying in Sun - we
need to eat our own dog food before anyone else will think of trying
it).

As such, I believe OASIS should establish a PKI for its use and issue
all Chairs digital certificates for signing official documents within
its archives.  The mechanics can be worked out once the principle is
decided by vote by the TC.

Arshad Noor
StrongAuth, Inc.