RE: Question about Locate Service

Yassir,

	I agree from the clients point of view. However from the service
point of view there are many cases in which a service can provide the locate
function without being able to perform validate. To perform validate you
have to have access to the certificate repository and the status
information, that is not needed for locate.

	The main reason locate is there is because without it XKMS forces a
model in which the client depends on the service for trust. While you may be
correct in that being the model to follow, it is not a good strategy to gore
sacred cows like the end to end principle unecessarily.

	For example, say there was an XKMS service that provided locate
service for the Federal Bridge CA on W2K. The part that W2K can't grok is
the locate over cross-certified domains. However the client does have a
pretty complete X.509 stack built in. There might well be a requirement for
the client to do trust processing in the client. So the client fetches a
cert chain using locate and verifies it using the validation path math which
is much easier (in the general case) than the chain location match.

	While you may well be right that the service model is the one to
adopt I see no reason to insist on baking that model into the protocol. XKMS
is going to have to work side by side with X.509/PKIX for many years. 

		Phill

Phillip Hallam-Baker FBCS C.Eng.
Principal Scientist
VeriSign Inc.
pbaker@verisign.com
781 245 6996 x227


> -----Original Message-----
> From: Yassir Elley - Sun Microsystems [mailto:Yassir.Elley@sun.com]
> Sent: Friday, January 18, 2002 4:49 PM
> To: stephen.farrell@baltimore.ie; Yassir.Elley@sun.com;
> pbaker@verisign.com
> Cc: www-xkms@w3.org
> Subject: RE: Question about Locate Service
> 
> 
> Phill,
> 
> I am not sure this is a very compelling use case. This would 
> only be useful if 
> the signature did not verify with the public key in the 
> certificate, because
> then the client would save the performance (and monetary) 
> cost of a validation.
> However, in the common case, the signature probably will 
> verify. So, in the
> common case, the client will be making two calls (a Locate 
> followed by a 
> Validate) and suffering the performance penalty of two calls, 
> two round trips, 
> etc, rather than just making a single Validate call. 
> 
> -Yassir.
> 
> 	Resent-Date: Fri, 18 Jan 2002 11:16:42 -0500 (EST)
> 	Resent-Message-Id: <200201181616.LAA04603@www19.w3.org>
> 	From: "Hallam-Baker, Phillip" <pbaker@verisign.com>
> 	To: "'stephen.farrell@baltimore.ie'" 
> <stephen.farrell@baltimore.ie>, 
> Yassir Elley - Sun Microsystems <Yassir.Elley@sun.com>
> 	Cc: www-xkms@w3.org
> 	MIME-Version: 1.0
> 	Subject: RE: Question about Locate Service
> 	Resent-From: www-xkms@w3.org
> 	X-Mailing-List: <www-xkms@w3.org> archive/latest/53
> 	X-Loop: www-xkms@w3.org
> 	Resent-Sender: www-xkms-request@w3.org
> 	List-Id: <www-xkms.w3.org>
> 	List-Help: <http://www.w3.org/Mail/>
> 	List-Unsubscribe: 
<mailto:www-xkms-request@w3.org?subject=unsubscribe>
	
	In some circumstances a client may have a key that is trustworthy
	(or whose trustworthiness is not the issue) and merely want to
	have the locate service provide the key information.
	
	For example a transaction processor may receive a signed message
	with an attached X.509v3 certificate and query the locate service
	to obtain the public key parameters so that the signature
verification
	can be performed.
	
	It is very likely that you would want to check the signature before
	you do the validation if you are paying a per validation fee.
	
			Phill
	

	> -----Original Message-----
	> From: Stephen Farrell [mailto:stephen.farrell@baltimore.ie]
	> Sent: Friday, January 18, 2002 11:04 AM
	> To: Yassir Elley - Sun Microsystems
	> Cc: www-xkms@w3.org
	> Subject: Re: Question about Locate Service
	> 
	> 
	> 
	> Yassir,
	> 
	> I can see two functions that locate can perform. The one you
mention:
	> 
	> > I could understand if the client asked the Locate service 
	> to return an
	> > X509 certificate or chain of certificates, and then the 
	> client did the
	> > validation himself. Is that the intended usage of the 
	> Locate service?
	> 
	> one variant of which is called DPD in the IETF PKIX context 
	> and secondly
	> I can also imagine a client using a locate on a name, getting 
	> a (set of)
	> KeyInfo elements, picking one, and then doing a validate (say
prior to
	> encryption). I'm not sure if others are considering this latter
case, 
	> but I think it might be useful.
	> 
	> Stephen.
	> 
	> -- 
	> ____________________________________________________________
	> Stephen Farrell         				   
	> Baltimore Technologies,   tel: (direct line) +353 1 881 6716
	> 39 Parkgate Street,                     fax: +353 1 881 7000
	> Dublin 8.                mailto:stephen.farrell@baltimore.ie
	> Ireland                             http://www.baltimore.com
	>