# Trusted QSL FAQ

1. Q. What is the difference between E-QSLs and tQSLs?
   A. tQSL is a special form of E-QSL that has been signed by the originator with a strong digital signature.

2. Q. What type of service does TrustedQSL.org offer?
   A. TrustedQSL.org doesn't really offer services. We provides information about TrustedQSL system and Open Source tools.

3. Q. Is DSA (Digtial Signature Algorithm) really secure?
   A. Yes, the only known attack against DSA is brute force. The public key is 1024 bits long. (talk about big numbers)

4. Q. What is wrong with the www.eQSL.cc ?
   A. First the tQSL does NOT exclude the use of a logbook server such as eQSL.cc or LoTW, it just add a strong third party trust protocol and removes the server for being the trusted arbitrator. In fact LoTW will use TrustedQSL libraries to protect the system.

5. Q. What is a Certification Authority(CA) and why are they important?
   A. A public key is just a very large number. In itself it has no meaning except that it has a matching private key. The trusted CA takes the public using a trusted means such as postal mail or other secure means and wraps it up into a signed certiicate. If there is any question about the certifcate being authenicate, it can be validate with the CA's certificate.

6. Q. Who grants CA status?
   A. Any person or group can become a CA. It is the award sponsors who must endorse the CA as being trusted for their program. It is outside the scope of this group to set policy for the award sponsors.

7. Q. Who are the CAs?
   A. Currently isn't any CAs because the software isn't finished, but ARRL will be the first CA. Since they are a major award sponsor they should be ones to grant CA status. TrustedQSL.ORG will issue "TEST" Certificate, but trustedQSL isn't going to be in the certificate business.

8. Q. Why should we trust TrustedQSL.org?
   A. There is no need to trust TrustedQSL.org. We just provide open source tools.

9. Q. What is a certificate (cert)? Is it the same as a public key?
   A. A cert contains the public key, call sign and other information, plus a signature of the CA that signed and endorse the public key.

10. Q. What can I sign with my cert?
    A. Nothing. Certs are only for validating signatures. You use a private key to sign a message. Any message can be signed.

11. Q. What is to stop an untrusted party from becoming a CA?
    A. Anyone can become a CA. The award sponsors has to endorse a CA before it has any trust.

12. Q. What happens if my cert get stolen?
    A. It doesn't matter. It is public information used to validate your signature. You can't anything bad with it.

13. Q. What happens if my secret key get stolen?
    A. This is a problem. You will need to contact your CA to have them revoke it.

14. Q. What is the down side of DSA signature?
    A. Public key signatures systems can be complex and hard to undertand. Our goal is to make it as simple as possible. The other down side is that public keys has to be certificated which requires a little effort.

15. Q. If digital signatures and certs are complex why force the users to use them?
    A. The most complex issue that users will have to deal with is authenication. Using PKI isn't what is complex. Even if ARRL used a standard password model the authenication would be the same.

16. Q. Can paper cards have a DSA signature?
    A. Yes, it could be done with bar code or printed on the card, but there isn't any current plan to support paper cards.
17. Q. Do I need to be connected to the Internet to sign QSLs?
    A. No. TrustedQSL can be signed and send by any means. Included but not limited to packet radio, floppy disk, CD-R/RW, Paper QSL cards.

18. Q. Do I need to be connected to the Internet to validate tQSLs?
    A . No, you just need a trusted means to obtain the CAs certs.

19. Q. What is Open Source? Why is it important to TrustedQSLs to be open source?
    A. Open Source concept is where the copyright holder wishes that the source code be open to anyone to use. There are different types of open source licenses. Some open source licenses requires that any derived work also be open source. TrustedQSL uses a much less restrictive licenses. We want for proprietor software vendors to use our libraries and our licenses allows them to do so without a licenses fee or requirement to disclose their source code. For tQSL to become the standard much the ADIF is for format, then nothing should kept vendors of software logbooks from using it. One way to do this is to make the source and the standard open. Anyone can use it without fee.

20. Q. Your effort duplicates commercial product. Products such as Adobe Acrobat, while not free, do offer digital signatures with non-repudiation today. These are now legal to use in commerce.
    A. See last answer.

21. Q. The system you propose is certainly open to fraud, in that a group of users could easily conspire. Perhaps this won't happen, but we've seen cases of this among VEs, which is troubling.
    A. It can happen. Another solution would be for a major groups such as the ARRL to become CAs. Any system will not be perfect. Just ask Verisign and Microsoft.

22. Q. Will ARRL and other award sponsors accept tQSL?
    A. TrustedQSL has been selected as the PKI for the ARRL LoTW.

23. Q. You guys are doing some cool stuff. Can I be apart of it?
    A.Sure join the TrustedQSL reflector and drop me a line wa1gon@arrl.net and tell me a little about yourself.