On Wed, 2004-07-07 at 01:27, Alexander Sack wrote:
> Hi,
>
> >I'm happy and keen to talk, and interested how jxta supports trust.
> >
> >
> >
> We are currently supporting point to point integrity and privacy
> leveraging public private key
> mechanisms, but have not yet come to decide on which trust model we can
> put this to ensure
> complete trustable p2p for our IM. I currently cannot tell how the jxta
> base system suggest this
> to be solved, but AFAIK jxta at the current state does not ship with a
> complete PKI.
>
I read on the JXTA site about Poblano - the distributed trust network
envisaged for JXTA. This does not limit which PKI to use (they talk
about X.509 and PGP).
> For our jxta based messenger, some kind of community based trust - like
> known from pgp - seems to be
> reasonable. But as I mentioned we have not yet been working on adding
> trust, so this chapter is a completely unresolved issue at the moment.
> All help and ideas on improving this are welcome.
>
SPKI can work virtually identically to PGP. On the other hand it can
work just like X.509! One difference to them both, is its integral
authorisation capability.
> In order to figure out, howto add some kind of PKI infrastructure to the
> jxta network (especially
> the groups of our IM) I need to know some details on your PKI
> technology. What kind
> of database (keystore) do you rely upon to establish trust? Do you
> access a central database with public keys and certificates or is it
> kept adaptable in some way, so an application developer can decide where
> and howto get certain certificates to establish trust?
> I am curious about this, because at best we would find a solution to use
> jxta means
> to store the data of the trust database and thus I think its likely that
> lookup mechanisms,
> etc. included in the current SPKI implementation (if any) will not work
> out of the box for
> jxta-only/jsdsi.
>
jsdsi is still an early product (like JIM) and does not (and will not)
limit its use to one model. Both a centralised or totally distributed
certifcate store model will be catered for. Currently we have an
in-memory store (mainly for testing), an LDAP store and a protoype jdbc
store. Creating a 'java keystore' approach will be trivial (jsdsi JCE
enabled, with its own Provider etc.)
> What do you think?
>
I think I should approach the JXTA group and make sure they are aware of
SPKI.
I also think that all the jsdsi users/developers (and people in the SPKI
world) would love the idea of a SPKI enabled IM.
I'll try to get time to read more about JXTA over the next few days.
Thanks,
Sean
>
> >Regards,
> >
> >
> >Sean
> >
> >
> >
> Cheers,
>
> Alexander
>
> p.s. sorry I had no time to read your website in detail yet - I will
> look into it ASAP
--
Dr. Sean Radford, MBBS, MSc
sra...@bl...
http://bladesys.demon.co.uk/
|
