RE: Question about Locate Service

In some circumstances a client may have a key that is trustworthy
(or whose trustworthiness is not the issue) and merely want to
have the locate service provide the key information.

For example a transaction processor may receive a signed message
with an attached X.509v3 certificate and query the locate service
to obtain the public key parameters so that the signature verification
can be performed.

It is very likely that you would want to check the signature before
you do the validation if you are paying a per validation fee.

		Phill

Phillip Hallam-Baker FBCS C.Eng.
Principal Scientist
VeriSign Inc.
pbaker@verisign.com
781 245 6996 x227


> -----Original Message-----
> From: Stephen Farrell [mailto:stephen.farrell@baltimore.ie]
> Sent: Friday, January 18, 2002 11:04 AM
> To: Yassir Elley - Sun Microsystems
> Cc: www-xkms@w3.org
> Subject: Re: Question about Locate Service
> 
> 
> 
> Yassir,
> 
> I can see two functions that locate can perform. The one you mention:
> 
> > I could understand if the client asked the Locate service 
> to return an
> > X509 certificate or chain of certificates, and then the 
> client did the
> > validation himself. Is that the intended usage of the 
> Locate service?
> 
> one variant of which is called DPD in the IETF PKIX context 
> and secondly
> I can also imagine a client using a locate on a name, getting 
> a (set of)
> KeyInfo elements, picking one, and then doing a validate (say prior to
> encryption). I'm not sure if others are considering this latter case, 
> but I think it might be useful.
> 
> Stephen.
> 
> -- 
> ____________________________________________________________
> Stephen Farrell         				   
> Baltimore Technologies,   tel: (direct line) +353 1 881 6716
> 39 Parkgate Street,                     fax: +353 1 881 7000
> Dublin 8.                mailto:stephen.farrell@baltimore.ie
> Ireland                             http://www.baltimore.com
>