Trusted QSL FAQ
- Q. What is the difference between E-QSLs and tQSLs?
A. tQSL is a special form of E-QSL that
has been signed by the originator with a strong digital signature.
- Q. What type of service does TrustedQSL.org offer?
A. TrustedQSL.org doesn't really offer
services. We provides information about TrustedQSL system and Open Source tools.
- Q. Is DSA (Digtial Signature Algorithm) really secure?
A. Yes, the only known attack against DSA is
brute force. The public key is 1024 bits long. (talk about big numbers)
- Q. What is wrong with the www.eQSL.cc ?
A.
First the tQSL does NOT exclude the use of a logbook server such as eQSL.cc or
LoTW, it just add a strong third party trust protocol and removes the server
for being the trusted arbitrator. In fact LoTW will use TrustedQSL
libraries to protect the system.
- Q. What is a Certification Authority(CA) and why are they
important?
A. A public key
is just a very large number. In itself it has no meaning except that it
has a matching private key. The trusted CA takes the public using a
trusted means such as postal mail or other secure means and wraps it up into a
signed certificate. If there is any question about the certificate being
authenticated, it can be validated with the CA's certificate.
- Q. Who grants CA status?
A.
Any person or group can become a CA. It is the award sponsors who must
endorse the CA as being trusted for their program. It is outside the
scope of this group to set policy for the award sponsors.
- Q. Who are the CAs?
A.
Currently isn't any CAs because the software isn't finished, but ARRL will be
the first CA. Since they are a major award sponsor they should be
ones to grant CA status. TrustedQSL.ORG will issue "TEST"
Certificate, but trustedQSL isn't going to be in the certificate business.
- Q. Why should we trust TrustedQSL.org?
A. There is no need to trust TrustedQSL.org. We
just provide open source tools.
- Q. What is a certificate (cert)? Is it the same as a public key?
A. A cert contains the
public key, call sign and other information, plus a signature of the CA that
signed and endorse the public key.
- Q. What can I sign with my cert?
A.
Nothing. Certs are only for validating signatures. You use a private key to
sign a message. Any message can be signed.
- Q. What is to stop an untrusted party from becoming a CA?
A. Anyone can become a CA. The award sponsors has
to endorse a CA before it has any trust.
- Q. What happens if my cert get stolen?
A. It doesn't matter. It is public information
used to validate your signature. You can't anything bad with it.
- Q. What happens if my secret key get stolen?
A. This is a problem. You will need to contact
your CA to have them revoke it.
- Q. What is the down side of DSA signature?
A. Public key signatures systems can be complex
and hard to understand. Our goal is to make it as simple as possible. The other
down side is that public keys has to be certificated which requires a little
effort.
- Q.
If digital signatures and certs are complex why force the users to use
them?
A. The
most complex issue that users will have to deal with is authentication.
Using PKI isn't what is complex. Even if ARRL used a standard password
model the authentication would be the same.
- Q. Can paper cards have a DSA signature?
A. Yes, it could be done with bar code or printed
on the card, but there isn't any current plan to support paper cards.
- Q. Do I need to be connected to the Internet to sign QSLs?
A. No. TrustedQSL can be signed and send by any
means. Included but not limited to packet radio, floppy disk, CD-R/RW, Paper
QSL cards.
- Q. Do I need to be connected to the Internet to validate tQSLs?
A . No, you just need a trusted means to obtain
the CAs certs.
- Q. What is Open Source? Why is it important to TrustedQSLs to be open source?
A. Open
Source concept is where the copyright holder wishes that the source code be
open to anyone to use. There are different types of open source
licenses. Some open source licenses requires that any derived work also
be open source. TrustedQSL uses a much less restrictive licenses.
We want for proprietor software vendors to use our libraries and our licenses
allows them to do so without a licenses fee or requirement to disclose their
source code. For tQSL to become the standard much the ADIF is for
format, then nothing should kept vendors of software logbooks from using
it. One way to do this is to make the source and the standard open. Anyone can
use it without fee.
- Q. Your effort duplicates commercial product.
Products such as Adobe Acrobat, while not free, do offer digital signatures
with non-repudiation today. These are now legal to use in commerce.
A.
See last answer.
- Q. The system you propose is certainly open to fraud,
in that a group of users could easily conspire. Perhaps this won't happen, but
we've seen cases of this among VEs, which is troubling.
A. It can happen. Another solution would be for a
major groups such as the ARRL to become CAs. Any system will not be perfect.
Just ask Verisign and Microsoft.
- Q.
Will ARRL and other award sponsors accept tQSL?
A. TrustedQSL has been selected as the PKI for
the ARRL LoTW.
- Q. You guys are doing some cool stuff. Can
I be apart of it?
A.Sure join the TrustedQSL reflector and drop me a line wa1gon@arrl.net
and tell me a little about yourself.