I can not support the charter as long as it allows this group to
create a new email signature protocol.
If I'm alone or even a minority in that view, ship it to the IESG.
I'll
make my comments again during "Last Call."
If others agree with me now would be a good time to speak up.
On Oct 3, 2004, at 5:02 PM, George Gross wrote:
I too have yet to hear a cogent explaination why S/MIME with
appropriate
header information included under the signature would not
handle this
problem. If I'm beating a dead horse, plz let me know where this
thrashing has been archived (I acknowledge that I'm new to
this list).
I have to agree with Jim and George here.
In addition to the arguments they have given, I want to point out the
following: we've been told that time is in short supply and
that even
taking 2 extra months to understand our requirements will cause
problems. If that is so, then we cannot risk time on a new
scheme; we
must limit the scope of the charter to S/MIME or PGP.
-andy
I would prefer to see a solution that utilised existing standards
signature formats.
Right now we do not any proposals that use either PGP or S/MIME - but
I'm sure that's resolvable :)
Obviously we all want the 'BEST' solution. If the 'BEST' solution
absolutely must have a new signature format then we will need to reach
consensus on a new signature format. If there are EQUAL solutions - one
with a new format and one with an existing format then using an existing
format is clearly desirable.
From what I have seen the strongest arguments come not from the failings
of existing formats but from trying to re-invent the wheel because of a
lack of global-trust chains for either PGP or X.509. e.g. By publishing
a standalone key in DNS and verify it against DNS. If the problem is
with the trust-chain and the distribution then we don't need a new
signature format, rather we need a trust and key distribution channel.
Regards,
Craig