Direct Project Overview

Direct project.

Basically, it’s all about trust and security.
Based on this idea, it actually doesn't have to be emails. It could be socket communication, and could also be http messages. The government driven Direct Project choose SMTP as their communication protocol  which is emails.

From the sending and receiving point of view,

“If you trust me and would like to receive message from me, then you put my certificate in your trust list. And I’ll put your certificate into my trust list to send you secure message.”

Once one organization put one other organization’s certificate into its trust list, it means the organization can send message to the organization and read message from the organization.

How to trust?

Based on Certificate.

How to trust a certificate?

Actually, it’s trust of the authority who issued the certificate. Then verify the signature of the certificate is right or not, using the issuer CA’s public key.

Trust Chain.

In direct project’s Applicability Statement, it mentions that “The address trusts any valid leaf certificate whose certificate chain contains at least one certificate from the address’s Anchor list.”

It means that as long as your certificate has relationship to one CA that has been trusted by me. I’ll trust you.

So here come two concerns based on the core element ‘certificate’ of direct.

  -----Certificate Discovery.

 -----Certificate Management.

Currently in Direct Project, there are two ways build in to hold its own certificates. One is using DNS, the other is using LDAP. Main reasons of picking these two ways I think it’s because these two ways are the most widely known and supported mechanism. Direct has its ambition, it wants it to replace Fax in doctor’s work life. So to make this project easier to be widely accepted and easier to be integrated, DNS and LDAP is the most possible way.

So the certificate discovery is basically replying on the DNS or LDAP technology.

Certificate management.

The certificate could be issued to ‘domain(organization)’ and could be issued to ‘user’.

Different CAs could pick the certificates that it would like to trust.

Well, direct project is a really good push to MU2.

But personal concern is, with the increasing of trust partners, the management of certificates will be harder.

The certificates number could explode, higher pressure when more users involved.

But compared to its benefit, it seems like this kind of issue is not an issue.

In direct project, what they did is first create one domain in the service, then upload trusted certificates of that CA into the trust anchors of this CA.

If program can call the API of direct service directly, direct can be easily integrated with other system.