<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=utf-8">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor=white lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>The absurdity is based on your conception that a higher layer
protocol entity is duty bound to interpret the signals of a lower layer in a
conforming manner. This is just not so. You are being perhaps far to religious
about protocol stacks!<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Take an example from secure X.400 military email. The so called
proof of delivery control is generated by a delivery MTA upon “delivering” a
mail to a user agent or msg store. The whole point of distinguishing this “delivery”
from the alternative “proof of receipt” security services is that the delivery
semantics is not under the control of the user, unlike the assertion of proof
of receipt. X.435 EDI/X12 built yet further semantics above and beyond receipt,
concerned with “handling” signals – taking formal “responsibility for
processing”.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Now, do all MTAs abide by the requirement to send out a
signature, proving the act of delivery when its requested? NO. Receiver’soperational
security policy dictates that said act is a violation of policy, concerning
information containment rules and covert channels. The operational policy-based
deployment is thus made “non- complying” in this sense, even tho the software libraries
are in fact complying (because it has been tested to correctly work, when used “in
conforming mode”).<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Openid is simply a (defined) non-conforming mode of HTTP. This fact
alone is not an absurd state of affairs. Its quite common when profiling stacks
of layer entities.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Now I do agree that openid discovery is woefully under analyzed.
And, one can argue that openid discovery over http is not right yet. I personally
feel in my gut its done mostly right – because of the way the designers ARE able
to rationalize its intended controls in terms of low level signals. However the
security professional in me really wants to see a formal model/spec that has proven
all the case. Its important for the next phase of adoption, by corporate types
wanting assurance of correctness etc.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";
color:windowtext'>From:</span></b><span style='font-size:10.0pt;font-family:
"Tahoma","sans-serif";color:windowtext'> general-bounces@openid.net
[mailto:general-bounces@openid.net] <b>On Behalf Of </b>Eddy Nigg (StartCom
Ltd.)<br>
<b>Sent:</b> Thursday, March 06, 2008 11:58 AM<br>
<b>To:</b> Eddy Nigg (StartCom Ltd.); John Kemp; general@openid.net<br>
<b>Subject:</b> Re: [OpenID] Calling OpenID 2.0 editors (was RE:Problems
withOpenID and TAG httpRange-14)<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Noah Slater: <o:p></o:p></p>
<pre><o:p> </o:p></pre><pre>It's not an assumption, it's bordering on the absurd that I have requote:<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>RFC 2616 § 10.3.4:<o:p></o:p></pre><pre><o:p> </o:p></pre><pre> The new uri is not a substitute reference for the originally requested resource.<o:p></o:p></pre><pre> <o:p></o:p></pre>
<p class=MsoNormal>No, but neither does the "originally requested
resource" must be the claimed_id<br>
<br>
<o:p></o:p></p>
<p class=MsoNormal><br>
<br>
<o:p></o:p></p>
<pre><o:p> </o:p></pre><pre>In this specific case, normalising to <a
href="http://example.com/">http://example.com/</a> is fine but if this<o:p></o:p></pre><pre>produces a chain of 302/303/307 redirects to <a
href="http://john.example.com/">http://john.example.com/</a> the HTTP<o:p></o:p></pre><pre>RFC explicitly states that <a
href="http://example.com/">http://example.com/</a> is the correct URI.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre> <o:p></o:p></pre>
<p class=MsoNormal style='margin-bottom:12.0pt'><a
href="http://john.example.com/">http://john.example.com/</a> is the claimed_id,
not a redirect. Of course one might submit <a href="http://john.example.com/">http://john.example.com/</a>
as the claimed_id from the beginning, but it's not required. <o:p></o:p></p>
<div>
<p class=MsoNormal>-- <o:p></o:p></p>
<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0>
<tr>
<td colspan=2 style='padding:0in 0in 0in 0in'>
<p class=MsoNormal>Regards <o:p></o:p></p>
</td>
</tr>
<tr>
<td colspan=2 style='padding:0in 0in 0in 0in'>
<p class=MsoNormal> <o:p></o:p></p>
</td>
</tr>
<tr>
<td style='padding:0in 0in 0in 0in'>
<p class=MsoNormal>Signer: <o:p></o:p></p>
</td>
<td style='padding:0in 0in 0in 0in'>
<p class=MsoNormal>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a><o:p></o:p></p>
</td>
</tr>
<tr>
<td style='padding:0in 0in 0in 0in'>
<p class=MsoNormal>Jabber: <o:p></o:p></p>
</td>
<td style='padding:0in 0in 0in 0in'>
<p class=MsoNormal><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a><o:p></o:p></p>
</td>
</tr>
<tr>
<td style='padding:0in 0in 0in 0in'>
<p class=MsoNormal>Blog: <o:p></o:p></p>
</td>
<td style='padding:0in 0in 0in 0in'>
<p class=MsoNormal><a href="http://blog.startcom.org">Join the Revolution!</a><o:p></o:p></p>
</td>
</tr>
<tr>
<td style='padding:0in 0in 0in 0in'>
<p class=MsoNormal>Phone: <o:p></o:p></p>
</td>
<td style='padding:0in 0in 0in 0in'>
<p class=MsoNormal>+1.213.341.0390<o:p></o:p></p>
</td>
</tr>
<tr>
<td colspan=2 style='padding:0in 0in 0in 0in'>
<p class=MsoNormal> <o:p></o:p></p>
</td>
</tr>
</table>
<p class=MsoNormal><span style='color:windowtext'><o:p> </o:p></span></p>
</div>
</div>
</div>
</body>
</html>