-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello Jon, others,
Okay, I see what you're saying, but is it necessary?
I think it is.
1. I think PGP is providing too little certainty about the meaning of a
signature with its current four-grade signing setup. At least, it is
not suitable for commercial use, which would be great to support. A
suitable policy mechanism can help in that case.
2. It is not smart to fall behind on other signing flexibility; PGP already
lacks the appeal to decision-makers that PKIX and even XML Signing have;
any URN-based policy initiative could therefore easily forget to
incorporate PGP and render it useless for that kind of application.
3. There are always work-arounds. For example, the kind of schemes
suggested under 2. could declare a website to do the translation from
URN to URL for the sake of PGP. Aside from that being awkward, it would
be a challenge to the longevity of the spec and may for that reason be
left out. We don't want that to happen.
A long time ago, the keyserver URL said URI and we changed it for
reasons that I can't remember. I think it's because we didn't think it
was necessary, that if it happened to be a URI, the worst that could
happen would be that someone wouldn't understand it, but that's always
a risk.
Indeed, the *keyserver* should not be referenced by name -- if you cannot
determine the location of a server what is it going to be good for?
For policies, I think we have a whole different matter at hand --
references to books, an ISSN-series of widely acknowledged signing policies
and ASN.1 OIDs are all good ways to point at a policy. Moreover, they are
supportive of Internet-wide schemes, which is rarely the case if a URL is
used.
Imagine that I would start pushing PGP-signers to follow
http://openfortress.nl/doc/some-policy.pdf
How would that make you feel? It would mean some company set it up. A
company with full control over the URL. Other companies are going to be
too proud or too smart to use the same signing policy *location*. Even if
they literally copy the content, the average signature validator would not
notice because the strings differ. In short, URLs are bad for
interoperable policies.
A URN-scheme on the other hand, can serve quite well for Internet-wide,
non-proprietary published policies. It can enforce the secure hash of a
document, which can only be weakly suggested in a URL. That would take
care of the pride issue. Furthermore, URNs can support rewriting to
equivalent forms, which would be helpful for supportive software to find
more matches than a simple string match can be.
If you happened to put in the policy URL an ISBN number, wouldn't it be
obvious what it meant? Wouldn't it work just fine?
There are always work-arounds, but why invite them? There are no
disadvantages to changing to a Policy URI.
I don't mind changing it, but is this just a difference without
distinction?
The change is vital in my opinion.
Thanks,
-Rick
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)
Comment: To understand digital signatures visit http://openfortress.nl
iD8DBQFCCIUsFBGpwol1RgYRAm41AJ4p8RN6BJ88+BW+gI7vkbodv6BH7ACeP2Wq
GL8TuglRzRNGvW2/PyeDH2Y=
=axg7
-----END PGP SIGNATURE-----