<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Vipin Rathor wrote:
<blockquote
cite="mid:33ab2aef0802280404m6cb20dccr467c9525ef26a4b4@mail.gmail.com"
type="cite">
<pre wrap="">hi,
Thanks for ur replies.
Since trust and security between relying party (RP) and OpenID
provider (OP) is a concern and there is no pre-existing trust
relationship between them, then why not to use the digital certificate
(PKI) based approach?
Let's say, both RP and OP have a X.509 certificate and whenever they
contact each other, they check other's certificate and do the chain
validation. Only when both are satisfied, they communicate with each
other.</pre>
</blockquote>
This only solves the problem of eavesdropping, not trust. In order to
provide a trust vehicle, a federated openid network or something like
this must be created where participants adhere to certain standards and
requirements (verifiable).<br>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>