<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 29 Oct 2019, at 16:43, Marcos Sanz via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" class="">openid-specs-ab@lists.openid.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">- Section 4.1: It's not clear to me what should happen if application of <br class="">the policy language results (or would result) in incorrect entity <br class="">metadata. While 4.1.2 and 4.1.3 state "applying the policy MUST lead to <br class="">failure" (this suggests process interruption and thus, probably, that the <br class="">policy being processed wouldn't change the metadata of the whole entity <br class="">under application), 4.4 says that in case of some claims having all their <br class="">values removed (a subset of the possible reasons for an incorrect end <br class="">state) only the responsible metadata statement will be removed. I think <br class="">that a clear/coherent statement for failure processing is needed for all <br class="">elements of the policy language if we expect this to be implemented <br class="">consistently.<br class=""></div></div></blockquote><div><br class=""></div>I see 2 cases:</div><div>1) Combining the different policies fails </div><div>2) Applying the combined policy to the entity metadata results in</div><div>incorrect metadata.</div><div><br class=""></div><div>Both cases must lead to the metadata being rejected.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="">- Section 7.1: It says "Once the Consumer has found a trust anchor it <br class="">wants to use, it MUST complete the trust chain by fetching the trust <br class="">anchor's self-signed entity statement" This sentence is in contradiction <br class="">with other parts of the spec: Section 2.2 clearly states that the trust <br class="">chain "ends with an entity statement issued by the trust anchor about the <br class="">top-most intermediate [...] or the leaf entity [...]", and it does thus <br class="">exclude from the chain the (certainly most probably existing) trust <br class="">anchor's self-signed entity statement. Verification algorithm of 2.2 <br class="">ignores the TA self-singed ES, so does Appendix A.1.7.<br class=""></div></div></blockquote><div><br class=""></div>Correct ! Missed that during the last rewrite.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="">- Section 7.2: It says "using the rules laid out in that [Section 2.2] <br class="">section" and it's not clear to me now what section is authoritative for <br class="">such an important thing as the trust chain validation algorithm. In any <br class="">case, duplication is definitely the worst option: A proof of that is that <br class="">the pseudo-code in 7.2 does not match completely what 2.2 says, even after <br class="">the aforementioned ammendment about ES[0] verfication. That's described in <br class="">next point.<br class="">- Section 7.2: The chain validation algorithm in 7.2 is broken. It looks <br class="">like it considers the TA self-signed statement to be part of the chain (cf <br class="">"for j=0,i verify that iss==sub"), but if that's the case, you'll easily <br class="">see by setting i=1 (no intermediaries, just one leaf and a TA) that you <br class="">only perform 2 signature verifications instead of the 3 that'd be needed <br class="">(self-signed leaf ES, TA about leaf ES, self-signed TA ES).<br class=""></div></div></blockquote><div><br class=""></div>It’s an error.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="">- Section 8.1: It says "If a leaf entity uses jwks_uri...", but I don't <br class="">see how jwks_uri would be honored at all in this spec, so I think the <br class="">statement about key rotation is void.<br class=""></div></div></blockquote><div><br class=""></div>Agree.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="">- Section 8.2: "A trust anchor must publish a self-signed entity statement <br class="">about itself. As described above in Section 2.2, it should be at the end <br class="">of the trust chain". Section 2.2 says actually the opposite, see further <br class="">up.<br class=""></div></div></blockquote><div><br class=""></div>Right, that sentence should be removed.</div><div><br class=""></div><br class=""><div class="">
<div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">- Roland</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Otium cum dignitate - latin proverb</div></div>
</div>
<br class=""></body></html>