Re: Loops (RE: CPIM changes)

Dave Crocker <[email protected]> writes:

> >> if one side of the gateway uses key/value and the other side uses compact
> >> binary, then how does end-to-end security work?
> 
> Derek> The Signature is over the canonical form, but that form is NOT
> Derek> necessarily the form transmitted over the wire.
> 
> sounds interesting.  where has this sort of abstraction-based,
> intermediary-friendly signing been done?  Given the fact that the goal you
> are seeking is an end-to-end mechanism, the sort of syntactic change by an
> intermediary, would be pretty unusual.

PGP does this when you sign a text message but generate a standalone
signature.  It signs the canonical form of the message, but you may
transmit the message in whatever lossless form you wish.

I am seeking an end-to-end security model with multiple CPIM-compliant
systems.  In other words, I'd like to see a SIP client be able to send
a secure message to a user running an APEX client, and send secured
presence information to someone running XMPP.  In this architecture,
syntactic change is quite likely in an intermediary.

> Derek> The question you SHOULD have asked is how does _encryption_ work?  In
> Derek> that case you do need to encrypt the canonical form.
> 
> i said 'security', in order to include both signing and sealing.

My appologies.  In my reading this yesteday I read it as signatures,
not security in general.  Sorry.

> d/

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email protected]                        PGP key available



  [reminder: [email protected] for non-technical discussions, please]