In this Issue: Perfect for Each Other
|
|
Some marriages seem meant to be: Extensible markup language (XML) is becoming the lingua franca of e-commerce; digital signatures offer companies a faster, cheaper method of conducting secure online transactions. VeriSign Inc., Microsoft, and WebMethods Inc. are the matchmakers bringing these two technologies together.
These companies all have a stake in raising the level of trust in online transactions: MountainView, Calif.-based VeriSign plays a significant role in the growing acceptance of digital signatures; WebMethods, based in Fairfax, Va., helps companies set up business-to-business (B2B) marketplaces; and Microsoft's .Net architecture and BizTalk server are largely targeted at online marketplaces.
For these marketplaces to mature and become more popular, businesses must be confident that transactions are legally enforceable and verifiable. (See "The Burden of Proof," Trust Management, page 46.) Digital signatures, which have the backing of federal law, can verify identities on both sides of the transaction and the content of the transaction itself. But adopting a public key infrastructure (PKI) framework, the basis of many digital signature technologies, is not simple and can be expensive.
But help may be on the way: Microsoft, VeriSign, and WebMethods recently introduced the XML key management specification (XKMS; see www.verisign.com/developer/xml), which they believe will simplify integrating digital signatures and data encryption with Web applications. They also hope to speed development of applications using these technologies by making XKMS publicly available and submitting the specification to Web standards bodies for consideration as an open Internet standard.
The companies assert that the XKMS spec, along with the recently drafted XML digital signature standards and the emerging XML encryption standard, can provide an open framework for interoperability across applications. (Microsoft plans to include XKMS in its .Net architecture.) XKMS is also compatible with the emerging standards for Web services description language (WSDL) and simple object access protocol (SOAP).
Theoretically, with XKMS, developers will no longer need to purchase and integrate proprietary toolkits from PKI software vendors. Instead, functions such as digital certificate processing, revocation status checking, and certification path location and validation will reside in servers to be invoked via XKMS. The developers involved, however, would need to agree on a standard schema - always a tricky question where XML is involved.
-Michelle Nichols
In this Issue:
 
|
|
|
|
| ||||||||||||||||||||||||||||||||
