taggers

Andrea Glorioso sama at miu-ft.org
Fri Jul 9 14:49:01 EDT 2004


>>>>> "Ryan" == Ryan Shaw <ryanshaw at sims.berkeley.edu> writes:

    > Can you explain this  a bit more? How   would a search  agent be
    > able to check whether  a given file truly  contained CC-licensed
    > content?

In Italy we  have an authority, called  CNIPA.  Any party (well, there
are  some prerequisites, of  course)  can  register with  CNIPA as   a
"registrar" and  be    able  to  issue   cryptographical  signing  and
timestamping services.  Registration with CNIPA only guaranteers legal
liability, it doesn't impact at all on the technicalities.

What you can do is produce a hash [0] of your digital work and ask one
of the above mentioned registered parties to sign it and timestamp it.
This is equivalent to saying "author A did create work X on time T".

At that point, verifying whether a file you download is by author X or
by author Y is trivial (in the mathematical sense of the word); adding
the  licensing information to  the above  scheme  is trival, too (same
sense).

One thing I forgot to say in my previous e-mail is that this scheme is
completely orthogonal to the problem at  hand. :) In other words, this
mechanism only proves the relationship between author, work, time, and
optionally metadata; it doesn't  create a direct  relationship between
data and metadata.

On the   other  hand,  I  don't see  (easy)   ways  to create   such a
relationship without a  trusted third party (or a  web of  trusted web
parties like PGP does [1]).

OR you can go down the TCPA/Palladium route (Trusted Computing and all
that  stuff).  I don't  want to go down  that  route, so I'm trying to
check other possibilities. 

If anything I wrote is confusing, feel free to tell me.

Bye,

--
Andrea Glorioso             sama at miu-ft.org         +39 333 820 5723
        .:: Media Innovation Unit - Firenze Tecnologia ::.
	      Conquering the world for fun and profit

[0] A  hash is  a function  which   produces a (usually) fixed  length
    number from the pot of bytes that your file  is composed of.  Good
    hashing functions (SHA-1, MD5, etc, etc) are guaranteed to produce
    different results for different files (or, the possibility to have
    the same   hash  for two different  files    is so low as   to  be
    negligible).

[1] Actually I'm still wondering whether a "web of trust" or a "tree
    of trust" is the best route to go for my project.


More information about the cc-metadata mailing list