<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">
Le 26/04/2013 18:35, tScheme Technical Manager a écrit :<br>
</div>
<blockquote
cite="mid:00bd01ce429c$0a86a250$1f93e6f0$@trevorah@tScheme.org"
type="cite">
<pre wrap="">Hi Ben,
I have already been involved in some discussions on what has become TD 131
and I'm not sure that it's useful to think of the auditors as fulfilling the
role of "juridical experts" (although they could also decide to offer that
service).</pre>
</blockquote>
<br>
From the paper:<br>
<br>
"The role of expert trusted third party could be provided by:<br>
<ul>
<li>Commercial organizations which make a business from giving
recommendation about certificates;</li>
<li>National governments which wish to facilitate e-commerce in
their countries;</li>
<li>An international body like the UN in order to facilitate
international trade"</li>
</ul>
<br>
The list isn't exhaustive, but the idea is to add a third (or
fourth?)-party actor. Auditors already being part of the process, I
doubt they can play 2 roles.<br>
<br>
<blockquote
cite="mid:00bd01ce429c$0a86a250$1f93e6f0$@trevorah@tScheme.org"
type="cite">
<pre wrap=""> My simplistic understanding is that I as a relying party would
formally contract with a JE service and then, whenever I receive a
Certificate (e.g. an SSL certificate when I log on to an e-Commerce site), I
would send a copy of the certificate to my JE service and ask them whether I
should trust it or not - i.e. I do not rely on the Browser making that
decision for me.</pre>
</blockquote>
<br>
Along with the scoring about the certificate, the trust broker would
also list usage limits about that certificate (role, monetary
amounts, ...).<br>
<br>
The idea seems to date back to 2008, by the same authors.<br>
</body>
</html>