[keyassure] WebID at W3C and keyassure

[Henry Story <[e-mail]>]

Hi,

	The W3C has started the WebID incubator group http://tinyurl.com/webidxg which is continuing work previously known as foaf+ssl in a more formal setting. I bring this to your attention because the foaf+ssl protocol [1], is conceptually very similar to what I believe keyassure is setting out to do. (I have not seen a draft spec yet, and am going from the group description).

   Where keyassure is attempting to identify a server using uniquely identifying information in the DNS, WebID is identifying an end user (human, robot or agency), via a profile document containing cryptographically uniquely identifying information placed in the web. Keyassure coul probably use the dns typed subject alternative name to identify the verify X509 certifactes, WebID uses the SAN (and IAN) with https IDs to identify the agent. We are both using canonical referential lookups to get the meaning of a name (Domain Name with keyassure, HTTP+TLS with WebID) which we can then use to prove referential integrity (authentication).

   So this parallel would by itself be enough to bring this to your attention. But it turns out that WebID could become all the easier to deploy and use if keyassure works, since TLS on the server will become much easier to deploy. Furthermore it makes some very interesting things possible, as discussed for example in "Turning every Web Server into a CA", 

http://lists.w3.org/Archives/Public/public-xg-webid/2011Feb/0060.html

For this use case, I think it would help there if the full public key were in the DNS. 

WebID is really about enabling a distributed secure social web. [3]

In any case I think it would be very useful to make sure we track each other's work. I am subscribed to this mailing list now, and our conversations are fully public too. Joining the mailing list is easy http://lists.w3.org/Archives/Public/public-xg-webid/ 
and we welcome contributions. It is quite easy to join the XG also, if you feel a desire to participate more actively. :-)

Henry Story


[1]   in development here
    http://www.w3.org/2005/Incubator/webid/spec/
[2] "How does Secure Authentication Work in FOAF+SSL" has an illustration that helps see the parallel. http://www.w3.org/wiki/Foaf%2Bssl/FAQ#How_does_Secure_Authentication_Work_with_FOAF.2BSSL.3F
[3] see the videos posted on my home page:

Social Web Architect
http://bblfish.net/