Direct project.
Basically, it’s all about trust and security.
Based on this idea, it actually doesn't have to be emails. It could be socket communication, and could also be http messages. The government driven Direct Project choose SMTP as their communication protocol which is emails.
Based on this idea, it actually doesn't have to be emails. It could be socket communication, and could also be http messages. The government driven Direct Project choose SMTP as their communication protocol which is emails.
From the sending and receiving point of view,
“If you trust me and would like to receive message from me,
then you put my certificate in your trust list. And I’ll put your certificate
into my trust list to send you secure message.”
Once one organization put one other organization’s certificate
into its trust list, it means the organization can send message to the organization
and read message from the organization.
How to trust?
Based on Certificate.
How to trust a
certificate?
Actually, it’s trust of the authority who issued the
certificate. Then verify the signature of the certificate is right or not,
using the issuer CA’s public key.
Trust Chain.
In direct project’s Applicability
Statement, it mentions that “The address trusts any
valid leaf certificate whose certificate chain contains at least one certificate from
the address’s Anchor list.”
It means that as long as your certificate has relationship
to one CA that has been trusted by me. I’ll trust you.
So here come two concerns based on the core element ‘certificate’
of direct.
-----Certificate Discovery.
-----Certificate Management.
Currently in Direct Project, there are two ways build in to
hold its own certificates. One is using DNS, the other is using LDAP. Main reasons
of picking these two ways I think it’s because these two ways are the most
widely known and supported mechanism. Direct has its ambition, it wants it to replace
Fax in doctor’s work life. So to make this project easier to be widely accepted
and easier to be integrated, DNS and LDAP is the most possible way.
So the certificate discovery is basically replying on the
DNS or LDAP technology.
Certificate management.
The certificate could be issued to ‘domain(organization)’
and could be issued to ‘user’.
Different CAs could pick the certificates that it would like
to trust.
Well, direct project is a really good push to MU2.
But personal concern is, with the increasing of trust
partners, the management of certificates will be harder.
The certificates number could explode, higher pressure when
more users involved.
But compared to its benefit, it seems like this kind of
issue is not an issue.
In direct project, what they did is first create one domain
in the service, then upload trusted certificates of that CA into the trust
anchors of this CA.
If program can call the API of direct
service directly, direct can be easily integrated with other system.
