This is aimed at the manager of a technical team, primarily, but also at people getting into the field of cryptography and its application via Apache. I tried to write it approximating the tone of Schneier's Applied Cryptography, but it probably came out sounding much more low-brow.
There should be mention of what the OpenSSL code itself can do, and what requires external engine support (i.e., external signing operations), I think. I'm not entirely sure -- I posted it here primarily to engender a bit of discussion. (BTW, a thank-you goes out to Duncan Evans of Thawte for following up with me regarding the statements that I made in the initial document. He's still investigating exactly what happened when, but at this point the Thawte CPS v2.2 now defines a 'Medium' identity assurance, related to "domain-validated" certificates that it now issues under the SSL123 moniker.) -Kyle A Hamilton On 1/9/06, David Holmes <[EMAIL PROTECTED]> wrote: > Hey that's pretty neat. > > Question: Who is the target audience and what level of technical > ability should they be assumed to have? If they are reading this list > or looking through the openssl source code I would guess its higher than > the one that appears to be targetted by this fine document. > > I recommend replacing the "Conclusions" with a sentence that says > something like: > > If you have more money than time, for around $10K you can secure your > keys in a Level III FIPS 140-2 certified device (list of vendors would > follow). ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
