FW: Bob Blakley's workitems from 9/18 con-call

[Carlisle Adams <carlisle.adams@entrust.com>]

Title: FW: Bob Blakley's workitems from 9/18 con-call

Hi,

A small modification to Bob's wording.  This seems better to me, but if anyone has objections, please post...

Carlisle.

----------
From:   George Robert Blakley III[SMTP:blakley@us.tivoli.com]
Sent:   Tuesday, September 18, 2001 4:46 PM
To:     Carlisle Adams
Subject:        RE: Bob Blakley's workitems from 9/18 con-call

Carlisle,

I think you're right... I haven't thought this all the way through.  I
think the correct wording would say something
more neutral, like

       "The SubjectConfirmation method instructs the assertion issuer to
   whom the query is directed to ***generate the assertion in such a way
   that*** the Subject Designation information in the
   assertion it returns ***can be confirmed by a relying party*** using the
   specified SubjectConfirmation method"

Better?  If so, please feel free to post this correspondence to the list.

--bob

Bob Blakley (email: blakley@us.tivoli.com   phone: +1 512 436 1564)
Chief Scientist, Security and Privacy, Tivoli Systems, Inc.

Carlisle Adams <carlisle.adams@entrust.com> on 09/18/2001 03:38:12 PM

Please respond to Carlisle Adams <carlisle.adams@entrust.com>

To:   George Robert Blakley III/Austin/IBM@IBMUS
cc:
Subject:  RE: Bob Blakley's workitems from 9/18 con-call

Hi Bob,

Good write-up.� I just have one quick question...

   ----------
   From: � George Robert Blakley III[SMTP:blakley@us.tivoli.com]
   Sent: � Tuesday, September 18, 2001 1:23 PM
   To: ��� pato; security-services@lists.oasis-open.org
   Subject: ������ Bob Blakley's workitems from 9/18 con-call

(...some text deleted...)

   * When SubjectConfirmation appears in a Query

   ���� SubjectConfirmation includes:

   ��������� - the SubjectConfirmation method

   ��������� The SubjectConfirmation method instructs the assertion issuer
   to
   whom the query is
   ��������� directed to protect the Subject Designation information in the
   assertion it returns using
   ��������� the specified SubjectConfirmation method.

Did you really mean to use the word "protect" in the above sentence?� From
your discussion on today's teleconference, I got the impression that all
you meant was that the requester is asking the assertion issuer to have the
SubjectConfirmation method *accompany* the Subject Designation information
in the assertion it returns.� In other words, "please put this confirmation
method in the assertion", not "please protect the designation info with
this confirmation method".� (If the issuer is just blindly putting in
whatever it's asked to include, then there's no concept of "protection"
happening, is there?)

Carlisle.