<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc="http://microsoft.com/officenet/conferencing" xmlns:D="DAV:" xmlns:Repl="http://schemas.microsoft.com/repl/" xmlns:mt="http://schemas.microsoft.com/sharepoint/soap/meetings/" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ppda="http://www.passport.com/NameSpace.xsd" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcs="http://schemas.microsoft.com/data/udc/soap" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udcp2p="http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss="http://schemas.microsoft.com/office/2006/digsig-setup" xmlns:dssi="http://schemas.microsoft.com/office/2006/digsig" xmlns:mdssi="http://schemas.openxmlformats.org/package/2006/digital-signature" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:spwp="http://microsoft.com/sharepoint/webpartpages" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:pptsl="http://schemas.microsoft.com/sharepoint/soap/SlideLibrary/" xmlns:spsl="http://microsoft.com/webservices/SharePointPortalServer/PublishedLinksService" xmlns:Z="urn:schemas-microsoft-com:" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple style='word-wrap: break-word;
-webkit-nbsp-mode: space;-webkit-line-break: after-white-space'>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> John Bradley
[mailto:john.bradley@wingaa.com] <br>
<b>Sent:</b> Sunday, August 30, 2009 2:06 PM<br>
<b>To:</b> Peter Williams<br>
<b>Cc:</b> Story Henry; John@osuosl.org; openid-general@lists.openid.net<br>
<b>Subject:</b> Re: [OpenID] Windows Live ID OpenID CTP Status Update (August
2009)<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p>
<div>
<p class=MsoNormal style='margin-left:.5in'>One thing we do lack is a consensus
on what openID is other than a redirect based protocol with a symmetric shared
secret between the OP and RP per the openID 2.0 spec.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='margin-left:.5in'><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'>So a good first question to tackle
is should asymmetric cryptography RSA/ECDSA be a part of the core spec.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal style='margin-left:.5in'>If the answer continues to be no
then it takes a bunch of options off the table.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal style='margin-left:.5in'>I think the answer for extensions
like CX and secure discovery may well be different than for the core spec.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal style='margin-left:.5in'>I am interested in what people
thing openID is or should be going forward.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:#1F497D'>That which folks could not do to
enhance SSL itself for websso (because of the way IETF works, and who runs/influences
the contributors/editors of that forum), I see openid as having done through
market forces. Openid is to me an enhanced session manager for ssl sessionids,
with the added value of discovery and authorization controls – that allow
multiple “SSL connections” to be proxied UNDER policy control
(rather than ad-hoc http proxy/connects that just fashioned a MITM space).<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Now, the deployed SSL would need to be unhooked from the https-level
de-facto policy of tying trust to the DNS – which is currently partially governing
end-end connection policie (under ideas from 15 years ago (that have not moved forward
one iota)).<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>So, just as facebook have treated openid as a hidden protocol under
a UX flow (using only a slice of the protocol furthermore to do machine-machine
signalling), so one can continue the trend, working towards openid supporting machine-machine
authentication for web services, etc. This obviously leaves behind the
restriction of openid as being ONLY a foreground protocol, addressing UCI,
privacy, control and all the other in-your face issues.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>So, the more the SSl handshake/event-handlers and openid state
machines merge, the better. Then, a market will emerge for hardware that can do
NAT/load-balancer offloading of https/openid today, just as the same switches now
do multi-gigabit/s ssl offloading and proxing.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>If the same trends were also to be incorporating the yet more
powerful foaf+ssl ideas (which are admittedly 3-4 behind the adoption curve of
openid2), those switches would able to set to do what many used to think of
secure XML routers doing (the so-called AOS devices, from the likes of HP and
Intel). But rather than do it with messages, one would be doing it with
sessions – which we know has proven itself a scalable winner for fast
hardware. But those sessions would now have inferecing based routing –
which takes us above and beyond the dynamic routing regimes of the internet
backbones and into true virtual routing.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>If one goes with this trend analysis, yes public key is part of
openid, but through an ever tighter association with the SSL handshake and
event handlers, not because openid does an alternative( relatively crappy) job
of repeating what SSL does so well.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>There were attempts to add certain NR-features to openid, that unfortunately
got caught up in patent issues. But, many folks see a need for SSL to ALSO
allow the servers behind the loadbancer offloaders to retain a measured
of crypto-level relationship to the client. Here, again, I suspect openid could
be adding that something back to SSL (and be doing something useful without
getting into the patented areas).<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>If one accepts any of the above, then yes CX and secure
discovery are simply using this “new https” as a bearer, and openid
“extensions” are to such an ssl+openid-bearer what https apps are
to the SSL record layer today – consumers of generic session-oriented security
services. But, the https layer has moved on a generation.<o:p></o:p></span></p>
</div>
</div>
</div>
</body>
</html>