W3C home > Mailing lists > Public > www-xkms@w3.org > February 2003

RE: Serving static responses

From: Hallam-Baker, Phillip <pbaker@verisign.com>
Date: Wed, 5 Feb 2003 11:31:37 -0800
Message-ID: <CE541259607DE94CA2A23816FB49F4A310FF38@vhqpostal6.verisign.com>
To: "'Joseph Reagle'" <reagle@w3.org>, "Hallam-Baker, Phillip" <pbaker@verisign.com>, stephen.farrell@baltimore.ie
Cc: www-xkms@w3.org
This went to the list some time back, it is the Request Signature value
repeated in the response.

This means that you have a strong binding from the request to the
response, even if the service does not authenticate the request properly
the client knows that the response corresponds to the request.

The request 'signature' algorithm could be SHA-1 so this need not be
major protocol overhead.

   <!-- ResultAbstractType -->
   <complexType name="ResultAbstractType" abstract="true">
         <extension base="xkms:MessageAbstractType">
               <element ref="xkms:RequestSignatureValue" minOccurs="0"/>
            <attribute name="ResultMajor" type="QName" use="required"/>
            <attribute name="ResultMinor" type="QName" use="optional"/>
            <attribute name="RequestId" type="anyURI" use="required"/>
   <!-- /ResultAbstractType -->

> -----Original Message-----
> From: Joseph Reagle [mailto:reagle@w3.org]
> Sent: Wednesday, February 05, 2003 1:51 PM
> To: Hallam-Baker, Phillip; stephen.farrell@baltimore.ie
> Cc: www-xkms@w3.org
> Subject: Re: Serving static responses
> On Wednesday 05 February 2003 13:27, Hallam-Baker, Phillip wrote:
> > It is not a particularly strong mechanism, in particular it 
> is not at
> > all secure if the request is not authenticated which is why we have
> > introduced the strong binding to the request by means of the request
> > signature repeater.
> (What's the "request signature repeater"?)

Received on Wednesday, 5 February 2003 14:31:44 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 23:07:23 UTC