You are both right, about different attacks, and separating the attacks dissolves the disagreement about the first link.
Brian is right that truncation has to contradict a signed statement rather than fall to a policy judgment. A defense that depends on the verifier noticing something missing is not a defense. Yaron is right that committing chain length and the ordered hop set in the first link breaks the deployments brokering exists for. In his topology, subsidiaries insert and remove their own brokers, and the first hop cannot know the eventual shape of the chain. A commitment scheme that requires topology knowledge at origination welds the chain to one arrangement of intermediaries at signing time. Now split truncation into its three cases. Tail truncation: the line-of-sight design already defeats it, because each link names the audience of the next hop, so a chain cut short terminates in a link whose stated audience is not the verifying AS, and reconstruction fails closed. Middle removal: also defeated, because link k names its delegate, and removing hop k breaks the signer continuity between link k-1 and link k+1. Head truncation, meaning a middle broker re-originating a chain to hide what sits upstream of it: no commitment scheme defeats this, in either design, because the adversary is the party signing the first link. That case is a policy question the terminal AS answers from what it knows about its own registered clients, which is exactly Brian's point about operator-set broker expectations, and the reason a self-asserted client_roles value cannot carry it. So audience chaining handles everything signatures can handle, operator-set expectations at the AS handle the one thing they cannot, and downgrade stays a per-hop subset check either way. The first-link topology commitment buys nothing those two do not already provide, and it costs the dynamic chains that are the reason this draft exists instead of the register-everything countermeasure. Worth writing into the draft which check defeats which attack, so implementers do not reintroduce the commitment out of caution. Kieran Sweeney
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
