[Wpack] Charter proposal

[Phillip Hallam-Baker <[e-mail]>]

I see three distinct pieces of work here.

1) The container encoding
2) Determining the correspondence to HTTP
3) Working out what signatures actually mean

Developing an encoding format is relatively straightforward, we don't even
need to pick a single one. If people are happy having separate encodings to
support signed content and signed/encrypted content, that is fine with me.

But if this group is chartered with encryption excluded from the encoding
considerations, then that is a commitment to two encodings in perpetuity.
With the best will in the world, merging the streams two years after they
have diverged is a non-starter.

So what I would like to see is encryption in scope for the WG but not
decryption. And that is not a joke. Encryption is easy. The hard part is
deciding how to decrypt. And that is a problem that is properly outside the
scope of the WG.

The Mathematical Mesh provides two separate decryption schemes. One is the
use of EARLs, the other is a key distribution center scheme that gives a
subset of DRM capabilities I call confidential document control (preventing
redistribution of the plaintext is out of scope).

And WPACK need not depend on the Mesh for decryption capabilities. Nor
should it. All the package needs to do is to provide a means of identifying
the key used for encryption (hash of the public key or the symmetric key),
the key exchange information and provide an open extensible structure for
throwing in whatever advice you might want.

So I would like to see the 'DRM' etc. parts removed from the charter scope
and instead have encryption in scope and decryption out of scope.

Now the question we might want to consider is whether the same should be
true for the interpretation of signatures... I am not sure. It is certainly
a large and complex piece of work and the HTTP part is also large and
complex.