RE: Latest Rough Draft

Blair,

>I must also admit I don't understand what it is you wish to change in
>the draft.  I do understand that if one has encrypted information using
>an asymmetric key, then one can provide information about the private
>decryption key using a KeyInfo element containing an X509Data element
>holding a certificate with the public key.  But one could also provide
>this information using other elements defined for Signature KeyInfo such
>as KeyName, KeyValue, SPKIData, or PGPData.

O.K., I agree.

>Are you asking that text be added describing all the ways in which a
>signature KeyInfo element may carry information about an asymmetric
>encryption key?  This seems redunant to me.  Why isn't the reference to
>the XML Signature specification sufficient?

That may be sufficient, but I think additional text describing such ways
may be helpful.  This is because a key used for decryption is different
from that for verification.  That is, for verification, a user has to
obtain the public key referenced directly by a KeyInfo element, while, for
decryption, the user has to obtain the private key corresponding to the
public key referenced by the element.

Thanks,
Takeshi IMAMURA
Tokyo Research Laboratory
IBM Research
imamu@jp.ibm.com

Received on Thursday, 19 April 2001 00:25:55 UTC