FW: Bob Blakley's workitems from 9/18 con-call

Title: FW: Bob Blakley's workitems from 9/18 con-call

Hi,

A small modification to Bob's wording.  This seems better to me, but if anyone has objections, please post...

Carlisle.

----------

From:   George Robert Blakley III[SMTP:]

Sent:   Tuesday, September 18, 2001 4:46 PM

To:     Carlisle Adams

Subject:        RE: Bob Blakley's workitems from 9/18 con-call

Carlisle,

I think you're right... I haven't thought this all the way through.  I

think the correct wording would say something

more neutral, like

       "The SubjectConfirmation method instructs the assertion issuer to

   whom the query is directed to ***generate the assertion in such a way

   that*** the Subject Designation information in the

   assertion it returns ***can be confirmed by a relying party*** using the

   specified SubjectConfirmation method"

Better?  If so, please feel free to post this correspondence to the list.

--bob

Bob Blakley (email:    phone: +1 512 436 1564)

Chief Scientist, Security and Privacy, Tivoli Systems, Inc.

Carlisle Adams <> on 09/18/2001 03:38:12 PM

Please respond to Carlisle Adams <>

To:   George Robert Blakley III/Austin/IBM@IBMUS

cc:

Subject:  RE: Bob Blakley's workitems from 9/18 con-call

Hi Bob,

Good write-up.  I just have one quick question...

   ----------

   From:   George Robert Blakley III[SMTP:]

   Sent:   Tuesday, September 18, 2001 1:23 PM

   To:     pato; 

   Subject:        Bob Blakley's workitems from 9/18 con-call

(...some text deleted...)

   * When SubjectConfirmation appears in a Query

        SubjectConfirmation includes:

             - the SubjectConfirmation method

             The SubjectConfirmation method instructs the assertion issuer

   to

   whom the query is

             directed to protect the Subject Designation information in the

   assertion it returns using

             the specified SubjectConfirmation method.

Did you really mean to use the word "protect" in the above sentence?  From

your discussion on today's teleconference, I got the impression that all

you meant was that the requester is asking the assertion issuer to have the

SubjectConfirmation method *accompany* the Subject Designation information

in the assertion it returns.  In other words, "please put this confirmation

method in the assertion", not "please protect the designation info with

this confirmation method".  (If the issuer is just blindly putting in

whatever it's asked to include, then there's no concept of "protection"

happening, is there?)

Carlisle.