Re: [atoca] Call for submissions: Secure Alert Format

[Peter Saint-Andre <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 8/17/12 3:16 PM, Richard L. Barnes wrote:
> Hey Peter,
> 
> Thanks for this observation.
> 
> I think we were thinking of things in kind of the other direction: 
> 1. Define a general signed alert format 2. Define a way to
> transport those over XMPP (XEP-0127-bis)
> 
> This approach provides a more general functionality than sending
> CAP in secure XMPP (e.g., with an RFC 3923 signature).  The
> relationship is essentially the same as that between POSH and, say,
> attribute certificates over HTTP.  In one case, the signature is
> being provided by the protocol used to deliver the alert; in the
> other, the signature is attached to the object itself.  In the
> interest of being delivery-agnostic, ISTM that the object-based
> approach is preferable.
> 
> It may also be pretty trivial to extend XEP-0127 to support the
> security we describe here.  For example, if we allow detached
> signatures (which seems like a good idea), you could keep the same
> syntax as XEP-0127 and just add an attribute/element to carry
> signature data. (As long as the serialization of the CAP can't
> change...)

Yes, that all makes sense. My apologies if I missed earlier discussion
on this topic.

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/


-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAlAuuy4ACgkQNL8k5A2w/vxeoACg51083zPtLu0J860VwZ1tL32k
x40AoMsIxU7wFU3zc2VzPagEjm2TNoAb
=Mjcr
-----END PGP SIGNATURE-----