W3C home > Mailing lists > Public > www-ws-arch@w3.org > May 2002

RE: D-AR006.7 - Key management

From: Joseph Hui <jhui@digisle.net>
Date: Thu, 2 May 2002 17:56:08 -0700
Message-ID: <C153D39717E5F444B81E7B85018A460B06685957@ex-sj-5.digisle.com>
To: "David Booth" <dbooth@w3.org>, <www-ws-arch@w3.org>
When parties do symmetric key encryption (for data confidentiality, even
in an opportunistic encryption environment), they often need to establish
the symmetric key (for bulk data), either by key exchange, or key agreement
(e.g. Diffie-Hellman), thus involving PKE (e.g. one party encrypts the
symmetric key (or the keying material for deriving the symmetric key) with
its private key before sending it to the other party) or KDC(e.g. Kerberos). 

That said, IMO it may not be utterly unreasonable that we do Confidentiality
and leave Key Management out.  Less work the better? ;-)

Cheers,

Joe Hui
Exodus, a Cable & Wireless service
=========================================================

> -----Original Message-----
> From: David Booth [mailto:dbooth@w3.org]
> Sent: Thursday, May 02, 2002 12:40 PM
> To: www-ws-arch@w3.org
> Subject: D-AR006.7 - Key management
> 
> 
> 
> >"D-AR006.7 The security framework must include Key 
> Management, pertaining 
> >to Public Key Encryption (PKE) and Key Distribution Center (KDC)."
> 
> Why make WS get involved in key management issues?  This 
> seems beyond the 
> scope of what WS Arch needs to specify.
> 
> 
> -- 
> David Booth
> W3C Fellow / Hewlett-Packard
> Telephone: +1.617.253.1273
> 
> 
Received on Thursday, 2 May 2002 20:56:32 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 3 July 2007 12:24:59 GMT