[OpenID] OpenID Providers Invited to Join in an NSTIC Pilot Proposal

[Peter Williams]

I  do  have a technical/political question. It took me nearly 5 years go finally figure why certain design principles of openid were held (as it took 5 years for them to be realized in the likes of blogspot.com, and display their "breakthrough" benefits). Folks would say certain things to me over and over again (but it didnt get through, probably as the properties were yet to be realized in both a mainstream and then a tangible form). ON the topic you raise I have conjecture. It concerns the topic of only the issuer ever relying on the client cert (and then minting a openid assertion). This tying of cert issuing and cert relying and then openid assertion minting concerns me. This tying goes against what I was taught (that CAs MUST be distinct from any online agent). Let's say the issuer on certissuer.com access its own cert repository, when relying on the cert, taking 1 uS. But it breaks the rule, and now allows 3 other domains (certissuer.uk, certissuer.fr, certissuer.de) to also relyon the client cert (and mint openid assertions). These 3 have "special" access to the principal issuers cert repository, when relying on the cert, taking 1mS of delay (say). Perhaps the 4 sites have MPLS-VPN connecting them, and are federated legally (so the certs each issued can be relied upon by the others, reciprocally). Perhaps they are really manifestations of 1 multi-national company (operating in 4 jurisdictions). Im getting the feeling that im bucking the trend by wanting to break free of the constraints being imposed - (1) that only an IDP minting assertions can mint the certs (which is the exact opposite of what I was taught 20 years ago), and (2) that only the IDP can rely on certs (that only it issued).  Are these constraints "fundamentals" of the NSTIC-profile of openid? Is it absolutely fundamental and critical that these constraints are upheld (or it is just a "easy" first step, for convenience, say)? Im seeing the constraint popup, almost in concert, in 4 forums now. Either there is some central coordination group manipulating, or there is a "movement afoot" based on some valuable realization (that Im too dense or too fossilized to be picking up).           Date: Fri, 10 Feb 2012 15:58:03 -0800
From: fcorella at pomcor.com
To: openid-general at lists.openid.net
Subject: [OpenID] OpenID Providers Invited to Join in an NSTIC Pilot Proposal

FYI:
http://pomcor.com/2012/02/10/openid-providers-invited-to-join-in-an-nstic-pilot-proposal/

_______________________________________________
general mailing list
general at lists.openid.net
http://lists.openid.net/mailman/listinfo/openid-general 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-general/attachments/20120211/b23a5229/attachment.html>