<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Thanks David, <br>
<br>
SAML allows that the IDP sign assertions and/or messages. <br>
<br>
In this case, the IdP on the phone just uses the RSA keys it has on
hand to do the signing - which are those on the user's SIM. (there are
of course correlation/privacy implications of signing assertions with
user keys)<br>
<br>
There are times where its useful to be able to sign a SAML assertion
separate from the message that carries it (if you want to be able to
subsequently use it) - but I dont think this is one of them.<br>
<br>
So, I dont see why the fact that OpenID doesnt have something
comparable to 'assertions' would prevent the 'OP on phone' model you're
thinking of<br>
<br>
paul<br>
<br>
On 3/3/2010 3:58 PM, David Fuelling wrote:
<blockquote
cite="mid:51dae84d1003031258u7990723dt2569ddb8e4aa0349@mail.gmail.com"
type="cite">That's incredible, and very cool!!
<div><br>
</div>
<div>I don't know that much about SAML, but it seems like a SAML IdP
can use an individual user's key-pair to create an assertion that an RP
can use to allow a login (a "signed assertion")?</div>
<div><br>
</div>
<div>From TFA: "Then the IdP on the mobile phone creates an SAML
assertion and signs the assertion with the private key of the mobile
phone".</div>
<div><br>
</div>
<div>OpenID doesn't have the ability to sign assertions like this,
does it? </div>
<div><br>
</div>
<div><br>
</div>
<div>
<div class="gmail_quote">On Wed, Mar 3, 2010 at 12:03 PM, Paul Madsen
<span dir="ltr"><<a moz-do-not-send="true"
href="mailto:paulmadsen@rogers.com">paulmadsen@rogers.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000">Hi David, NTT built something
like you describe for SAML SSO -
specifically the scenario you list below in #4<br>
<br>
<a moz-do-not-send="true"
href="http://www.projectliberty.org/liberty/content/download/3960/26523/file/NTT-SASSO%20liberty%20case%20study.pdf"
target="_blank">http://www.projectliberty.org/liberty/content/download/3960/26523/file/NTT-SASSO%20liberty%20case%20study.pdf</a><br>
<br>
paul
<div>
<div class="h5"><br>
<br>
</div>
</div>
</div>
</blockquote>
</div>
</div>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
No virus found in this incoming message.
Checked by AVG - <a class="moz-txt-link-abbreviated" href="http://www.avg.com">www.avg.com</a>
Version: 9.0.733 / Virus Database: 271.1.1/2720 - Release Date: 03/03/10 02:34:00
</pre>
</blockquote>
</body>
</html>