XKISS Service Announcement

As part of my XKMS implementation effort I am announcing the availability
of three XKISS service endpoints located at:

http://62.77.172.83:4080/xkiss/soap12      SOAP 1.2 binding
http://62.77.172.83:4080/xkiss/soap11      SOAP 1.1 binding
http://62.77.172.83:4080/xkiss/plain-http  XKISS messages directly over HTTP


The following applies to all three endpoints:

- Aware of keys and certificates submitted as part of my sample
  messages; these should be used as the basis for the queries and
  signatures.

- Both unsigned and signed messages are accepted. Failure to verify and
  validate a signature yields a result containing Sender.NoAuthentication.

- All results are signed using the RSA XKMS responder key.

- Synchronous, Two-phase and Asynchronous exchanges are supported; the
  two-phase exchange takes precedence when both two-phase and
  asynchronous exchanges are indicated.

- The notification phase of the asynchronous exchange is currently manual
  and the delay is therefore significant.

- Responds to LocateRequest, ValidateRequest, StatusRequest and 
PendingRequest

- Respects requests for OpaqueClientData and RequestSignatureValue by
  copying these quantities from the request into the result.

- Supports KeyInfo elements KeyName, KeyValue, X509Data.X509Certificate
  in QueryKeyBinding

- The following Application/Identifier combinations are meaningful for use
  with UseKeyWith:
    urn:ietf:rfc:2633   deirdre@deirdrecorp.ie
    urn:ietf:rfc:2633   alice@alicecorp.ie
    urn:ietf:rfc:2633   bob@bobcorp.ie
    urn:ietf:rfc:2633   carol@carolcorp.ie
    urn:ietf:rfc:2633   harry@harrycorp.ie

- In order for a KeyInfo.KeyName to match a key/cert in a query, the 
ordering
  of the name components in the distinguished name is currently important.
  As the list is short I include the KeyName's that result in a match, 
below:

    CN=deirdre@deirdrecorp.ie,O=Deirdre Corp,L=Dundrum,ST=Dublin,C=IE
    CN=alice@alicecorp.ie,O=Alice Corp Ltd,L=Howth,ST=Dublin,C=IE
    CN=bob@bobcorp.ie,O=Bob Corp Ltd,L=Malahide,ST=Dublin,C=IE
    CN=carol@carolcorp.ie,O=Carol Corp Ltd,L=Dundrum,ST=Dublin,C=IE
    CN=harry@harrycorp.ie,O=Harry Corp Ltd,L=Blackrock,ST=Dublin,C=IE

    In JDK 1.4, X509Certificate.getSubjectX500Principal().getName() produces
    the desired DN.

- Unlike the samples I submitted, the result messages produced by these 
services
  are not formatted with easy reading in mind.

This is a first increment of work in progress and should be it used with 
compatible expectations.

Looking forward to getting feedback.

Regards
Tommy

tommy.lindberg@acm.org

_________________________________________________________________
STOP MORE SPAM with the new MSN 8 and get 2 months FREE* 
http://join.msn.com/?page=features/junkmail

Received on Saturday, 12 June 2004 08:10:40 UTC