Subject: Re: WG LAST CALL: draft-ietf-ltans-reqs-02.txt

From: Peter Sylvester <[email-masked]>
Date: Fri, 1 Oct 2004 18:53:46 +0200 (MEST)

I seem to agree with many of Denis remarks, unfortuntely I don't have
the time to answer before Tuesday, very late for personal reasons.

So I just make one remark (a detail)

> Since these evidences will be provided using cryptographic means, it is 
> important to maintain the cryptographic quality of theses evidences, even if 
> the signature policy under which the signatures have been done has expired.

I seem to have a wording problem here:

IMO The evidence may be PROTECTED by cryptographic means. Not provided? 

In general, the document seems mainly to address interfaces to some backend,
and not really front end user interface, some elements being things mentioned
by denis as: 

    - a first one to demonstrate to third parties the data originally
      placed originates from a given entity,

    - a second one to demonstrate to third parties that the data was
      originally accepted for storage, at a given time, by a server
      belonging to a given long-term archive service.

Denis proposes a lot of new text, which I think should be carefully read
and combined with the current req if we agree all on that. 

Peter
Off to homeland :-)

---

From: Ernst G Giessmann <[email-masked]>
Date: Mon, 04 Oct 2004 08:44:40 +0200

Dear all,
I would like to support Peter Sylvester, he wrote:
...
> and combined with the current req if we agree all on that. 

There is one point Denis raised, that is very important. I guess that we
can compare it with the digital/electronic signature issue:
The technical solutions for digital signatures (hash'n'sign) are quite
clear and I would say finalized, whereas the answer on the question what
a electronic signature as the future replacement for handwritten
signatures is can not be given as easily.

The cryptographic maintenance policy is one of the crucial points as it
is the signature policy for electronic signatures. This policy may be
explicit or implicit, but it *must* be there.

So I would suggst to extend a bit the discussion time. It is for
Long-Term and don't hurry up ;-)

Regards,
Ernst

-- 
	Ernst G Giessmann
	T-Systems GmbH ITC-Security
	Goslarer Ufer 35, D-10589 Berlin
	phone:+49-30-3497-4342 mailto:[email-masked]