Re: [security-jc] FW: security forum program

[Phil Griffin <phil.griffin@asn-1.com>]

Darran Rolls wrote: (in part)

> Some comments, observations and suggestions:
> 
> Re Benefits.  Now that this is a jointly sponsored event, it shows the
> world that we are all working together...
> 
> Re Agenda "Security Standards Architecture - 3".  Does this imply that
> we should have a draft of a common "vocabulary/taxonomy" defined and
> presented?  How does this effect/imply acceptance of 1.3 in [1]?
> 
> Re Agenda "Liberty Alliance". IMO we should clearly address MS-Passport
> as well (integration and co-existence if nothing else).  I say this as
> MSFT is participating in the conference, there are a number of .NET
> sessions on track and it's something we are going to have to at least
> discuss anyway.


The XCBF work might be relevant here. And again, co-existence
may be the watch word, since XCBF defines digital signatures
on XML markup but relies on neither W3C XML Schema nor XMLDSIG.

The signature process is much more simple, and very similar in
part to that employed in X.509 certificates. It may be that the
secure biometric information defined in XCBF can be carried in
the same manner as X.509 certificates, as opaque data. For the
Cryptographic Message Syntax type used in XCBF, the SignedData
is really just a variant of the signature process used in X.509.

So, you still end up with only two signature processes, the simple
signature on a canonical encoding of an ASN.1 value (either using
the Distinguished Encoding Rules (DER) as in X.509 when compact
transfer is needed in wireless/remote or high transaction volume
systems is needed, or the canonical XML Encoding Rules (cXER) as
in XCBF which is fine for environments that do not have bandwidth
or storage constraints).

Phil