On 10-Mar-06, at 11:59 AM, [EMAIL PROTECTED] wrote:
What I meant by "most basic level" was storage and transfer of attributes asserted by the user. You could design a DIX protocol where that is the only service provided. In that case, there is no need for verification. From their responses, I think both Dick and Rob agree with this.
I think you've teased out a simple but important point there Terry.
To summarize: a DIX protocol could be defined that allowed the signature to be optional in the Exchange Process. This protocol would support transfer of self-asserted attributes. The Verification Process would not be required. This eliminates the need for the membersite to communicate with an arbitrary (untrusted?) homesite, and eliminates a potential DoS problem.
I'm interested in the idea that a useful protocol could be defined just for
moving identity data items around. And then those could be either self-asserted attribute values or signed claims, and there could be multiple ways of encoding a claim and multiple ways of verifying that claim. In these terms, in dmd0, we have the HS generating an authentication claim, which is encoded in some message parameters, and then verified via a call-back mechanism. It might have been interesting for us to have taken a more generic approach and to have defined that as a simple-claim-verified-by-callback mechanism layered on top of the protocol that could have been used for other things. John _______________________________________________ dix mailing list [email protected] https://www1.ietf.org/mailman/listinfo/dix
