<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt">Peter,<br><br>> I do have a technical/political question.<br>> <br>> It took me nearly 5 years go finally figure why certain design<br>> principles of openid were held (as it took 5 years for them to be<br>> realized in the likes of blogspot.com, and display their<br>> "breakthrough" benefits). Folks would say certain things to me over<br>> and over again (but it didnt get through, probably as the properties<br>> were yet to be realized in both a mainstream and then a tangible<br>> form).<br>> <br>> ON the topic you raise I have conjecture. It concerns the topic of<br>> only the issuer ever relying on the client cert (and then minting a<br>> openid assertion). This tying of cert issuing and cert relying and<br>> then openid assertion minting concerns me. This tying
goes against<br>> what I was taught (that CAs MUST be distinct from any online agent).<br>> <br>> Let's say the issuer on certissuer.com access its own cert repository,<br>> when relying on the cert, taking 1 uS. But it breaks the rule, and now<br>> allows 3 other domains (certissuer.uk, certissuer.fr, certissuer.de)<br>> to also relyon the client cert (and mint openid assertions). These 3<br>> have "special" access to the principal issuers cert repository, when<br>> relying on the cert, taking 1mS of delay (say). Perhaps the 4 sites<br>> have MPLS-VPN connecting them, and are federated legally (so the certs<br>> each issued can be relied upon by the others, reciprocally). Perhaps<br>> they are really manifestations of 1 multi-national company (operating<br>> in 4 jurisdictions).<br>> <br>> Im getting the feeling that im bucking the trend by wanting to break<br>> free of the constraints being
imposed - (1) that only an IDP minting<br>> assertions can mint the certs (which is the exact opposite of what I<br>> was taught 20 years ago), and (2) that only the IDP can rely on certs<br>> (that only it issued).<br>> <br>> Are these constraints "fundamentals" of the NSTIC-profile of openid?<br><br>"NSTIC-profile of openid" is a bit premature, the blog post is just an<br>idea for a proposal for a pilot :-)<br><br>> Is it absolutely fundamental and critical that these constraints are<br>> upheld (or it is just a "easy" first step, for convenience, say)?<br><br>This is a very good question. Neither constraint is fundamental. <br><br>(1) is not fundamental. You can think of the openid assertion as an<br>alternative way of conveying the identity information in the<br>certificate to the relying party. In the blog post I asked for OpenId<br>providers who, in effect, would like to become CAs. I should
also<br>have asked for CAs who would like to become identity providers. Of<br>course if some relying parties verify the certificate themselves, then<br>the CA will have to issue CRLs, or provide an OCSP service. So things<br>wouldn't be any simpler for the CA, they would be more complicated.<br>But things would be simpler for those RPs that do not verify the<br>certificates themselves nor check the CRLs.<br><br>(2) is not fundamental either. As long as the IdP has access to the<br>certificate repository, it doesn't need to check a CRL. So<br>certissuer.uk, certissuer.fr and certissuer.de would fit the purpose.<br>It even makes sense to have an IdP that's associated with a particular<br>CA but does not have access to the certificate repository because the<br>repository is tightly coupled with the CA software and it is<br>impractical to provide external access to it. In that case the IdP<br>could verify certificates using a
CRL obtained from the CA. Again<br>this complicates the CA/IdP entity but may greatly simplify the RPs.<br>Notice that the IdP only has to deal with CRLs from one CA, which is<br>easy, whereas each RP may have to deal with CRLs from an unlimited<br>number of CAs, which is difficult or impossible.<br><br>> Im seeing the constraint popup, almost in concert, in 4 forums<br>> now. Either there is some central coordination group manipulating, or<br>> there is a "movement afoot" based on some valuable realization (that<br>> Im too dense or too fossilized to be picking up).<br><br>It's just an idea whose time has come, I would think. Could you tell<br>us what those forums are?<br><br>Francisco<br><br></div></body></html>