|
>Once again, Anders, you misrepresent facts
and/or take things out of context.
Dear Peter,
The IMO rather illustrative referenced slide
show, displays a basic O2O process using server-based signing
at the organization-only-level as the way of
achieving message integrity and authentication.
This is not end-to-end security, this is gateway/domain security.
BTW, the 11MB slide show does as far as I can
see, not reference the Federal PKI.
Since the FPKI WG to date have not published
any documents with guidelines, or specifications
on how to apply FPKI to collaborative O2O processes, this discussion gets somewhat less fruitful. My papers
indicate that it may not be possible to produce
such documents either as the end-to-end security
model, particularly with respect to encryption is not technically realistic to
use in the referenced scenario. Due to
this, I encourage the FPKI-WG to begin considering a revision of the FPKI
architecture.
regards
Anders Rundgren
Located in the EU, working for a US company, but here expressing my personal opinion |