Also, I suppose there is no problem putting the signature in the first tag
instead of marked out below the file. Either new versions of PGP and the
like will understand the new format or the browser will reformat the file
before it sends it to the external program for verification. I still think
it is important to utilize external programs for verification instead of
forcing the browser to implement the technology - first, because PGP and
the like are continually improved and the browsers should not have to keep
up with these improvements and second that there should be a central
keychain - or at least a central location and format for keychains so there
will be integration between WWW and correspondance concerning the files(for
example a mailto: in a signed or encrypted file could offer the user the
choice of encrypting their message with the authors' public-key).
One issue that needs to be resolved is whether or not there should be
allowed multiple signatures per file. I think by use of the new IDs this
could become fairly easy. Perhaps the browser could somehow mark each
signed area in the document with a symbol to show it is signed(with an X
through it if the authenication failed). Next to the symbol would be the
ID#(at the beginning and end of signed text) so nested signatures could be
used. The person could perhaps click on the symbol to display the name of
the signer or perhaps there could be a popup list somewhere showing IDs and
signer names.
Philip Trauring
--=--=====--=--=====--=--=====--=--=====--=--=====--=--=====--=--=====--=--
Philip Trauring philip@cs.brandeis.edu
Brandeis University MB1001
P.O. Box 9110 "knowledge is my addiction,
Waltham, Ma 02254-9110 information is my drug."
(617) 736-5282 ['94/95]
WWW home page: http://www.cs.brandeis.edu/~philip/home.html
--=--=====--=--=====--=--=====--=--=====--=--=====--=--=====--=--=====--=--