Trusted QSL FAQ
  - Q. What is the difference between E-QSLs and tQSLs? 
 A.    tQSL is a special form of E-QSL that 
  has been signed by the originator with a strong digital signature.
- Q. What type of service does TrustedQSL.org offer?
 A. TrustedQSL.org doesn't really offer 
  services. We provides information about TrustedQSL system and Open Source tools.
- Q. Is DSA (Digtial Signature Algorithm) really secure?
 A. Yes, the only known attack against DSA is 
  brute force. The public key is 1024 bits long. (talk about big numbers)
- Q. What is wrong with the www.eQSL.cc          ?
 A. 
  First the tQSL does NOT exclude the use of a logbook server such as eQSL.cc or 
  LoTW, it just add a strong third party trust protocol and removes the server 
  for being the trusted arbitrator.  In fact LoTW will use TrustedQSL 
  libraries to protect the system.
- Q. What is a Certification Authority(CA) and why are they 
  important?
 A.   A public key 
  is just a very large number.  In itself it has no meaning except that it 
  has a matching private key.  The trusted CA takes the public using a 
  trusted means such as postal mail or other secure means and wraps it up into a 
  signed certificate.  If there is any question about the certificate being 
  authenticated, it can be validated with the CA's certificate.
- Q. Who grants CA status?
 A.   
  Any person or group can become a CA.  It is the award sponsors who must 
  endorse the CA as being trusted for their program.  It is outside the 
  scope of this group to set policy for the award sponsors.
- Q. Who are the CAs?
 A.   
  Currently isn't any CAs because the software isn't finished, but ARRL will be 
  the first CA.  Since they are a major award sponsor they should be 
  ones to grant CA status.   TrustedQSL.ORG will issue "TEST" 
  Certificate, but trustedQSL isn't going to be in the certificate business.
- Q. Why should we trust TrustedQSL.org?
 A. There is no need to trust TrustedQSL.org. We 
  just provide open source tools.
- Q. What is a certificate (cert)?  Is it the same as a public key?
 A. A cert contains the 
  public key, call sign and other information, plus a signature of the CA that 
  signed and endorse the public key.
- Q. What can I sign with my cert?
 A. 
  Nothing. Certs are only for validating signatures. You use a private key to 
  sign a message. Any message can be signed.
- Q. What is to stop an untrusted party from becoming a CA?
 A. Anyone can become a CA. The award sponsors has 
  to endorse a CA before it has any trust.
- Q. What happens if my cert get stolen?
 A. It doesn't matter. It is public information 
  used to validate your signature. You can't anything bad with it.
- Q. What happens if my secret key get stolen?
 A. This is a problem. You will need to contact 
  your CA to have them revoke it.
- Q. What is the down side of DSA signature?
 A. Public key signatures systems can be complex 
  and hard to understand. Our goal is to make it as simple as possible. The other 
  down side is that public keys has to be certificated which requires a little 
  effort.
- Q.        
                  
    If digital signatures and certs are complex why force the users to use 
  them? 
 A.  The 
  most complex issue that users will have to deal with is authentication.  
  Using PKI isn't what is complex.  Even if ARRL used a standard password 
  model the authentication would be the same.
- Q. Can paper cards have a DSA signature?
 A. Yes, it could be done with bar code or printed 
  on the card, but there isn't any current plan to support paper cards.
 
- Q. Do I need to be connected to the Internet to sign QSLs?
 A. No. TrustedQSL can be signed and send by any 
  means. Included but not limited to packet radio, floppy disk, CD-R/RW, Paper 
  QSL cards.
- Q. Do I need to be connected to the Internet to validate tQSLs?
 A . No, you just need a trusted means to obtain 
  the CAs certs.
- Q.  What is Open Source? Why is it important to TrustedQSLs to be open source?
 A.   Open 
  Source concept is where the copyright holder wishes that the source code be 
  open to anyone to use.  There are different types of open source 
  licenses.  Some open source licenses requires that any derived work also 
  be open source.  TrustedQSL uses a much less restrictive licenses.  
  We want for proprietor software vendors to use our libraries and our licenses 
  allows them to do so without a licenses fee or requirement to disclose their 
  source code.  For tQSL to become the standard much the ADIF is for 
  format, then nothing should kept vendors of software logbooks from using 
  it. One way to do this is to make the source and the standard open. Anyone can 
  use it without fee.
- Q. Your effort duplicates commercial product. 
  Products such as Adobe Acrobat, while not free, do offer digital signatures 
  with non-repudiation today. These are now legal to use in commerce.
 A. 
  See last answer.
- Q. The system you propose is certainly open to fraud, 
  in that a group of users could easily conspire. Perhaps this won't happen, but 
  we've seen cases of this among VEs, which is troubling. 
 A. It can happen. Another solution would be for a 
  major groups such as the ARRL to become CAs. Any system will not be perfect. 
  Just ask Verisign and Microsoft.
- Q.          
                  
               
         Will ARRL and other award sponsors accept tQSL? 
 A. TrustedQSL has been selected as the PKI for 
  the ARRL LoTW.
- Q. You guys are doing some cool stuff. Can 
  I be apart of it?  
 A.Sure join the TrustedQSL reflector and drop me a line wa1gon@arrl.net
  and tell me a little about yourself.