Subject: [rtcweb] IdP and universal trust

From: Martin Thomson <[email-masked]>
Date: Thu, 29 Mar 2012 13:25:59 +0200

On 29 March 2012 08:08, Hadriel Kaplan <[email-masked]> wrote:
> Yeah I've been trying to figure out if there's some advantage to having a gateway be able to indicate "[email-masked]", once there is an IdP model.  I would think it's a major pita to deploy such a thing on gateways, unless there's a very popular IdP they could know everyone would trust.  It would actually be easier to just give the gateway a real TLS cert for DTLS to use, from a major CA, since gateways are the types of systems real certs would be reasonably possible to install on.

This is an important point, and I think that perhaps you missed the
distinction. Iff third party assertions are permitted, then the
problem that you refer to - namely, finding someone that others trust
- is somewhat difficult.  On the other hand, it is also true that you
can gain multiple assertions and increase the chances of finding an
acceptable IdP.

What seems more likely is that IdPs are only going to be authoritative
for their own domain.  The overall story is a lot easier to tell.
This has the nice quality that you don't have to trust the IdP, you
only have to trust their CA.

--Martin

---

From: Bernard Aboba <[email-masked]>
Date: Thu, 29 Mar 2012 14:46:22 +0200

There is a more basic problem here, which is that "legacy" scenarios are typically about reaching an E.164 number.   Given that IdP (or PKI for that matter) cannot be used to prove ownership of an E.164 number, such as [email-masked], it is difficult to see how identity can be provided by any mechanism for the legacy cases, and MITM attacks seem intrinsic to the scenario.  For example, [email-masked] is equivalent to [email-masked] so that first-party IdPs are not authoritative for E.164 numbers, and MITM attacks have long been acknowledged as possible within the SIP DTLS/SRTP framework (e.g. eviltwin.example.net can change the E.164 URI and resign the message via RFC 4474 without being detected).

On Mar 29, 2012, at 13:26, "Martin Thomson" <[email-masked]> wrote:

> _______________________________________________
> rtcweb mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rtcweb

---

From: Martin Thomson <[email-masked]>
Date: Thu, 29 Mar 2012 15:30:06 +0200

On 29 March 2012 14:46, Bernard Aboba <[email-masked]> wrote:
> For example, [email-masked] is equivalent to [email-masked]

Actually, if third party assertions were prohibited, these would be
considered different, though I suspect that a user would have some
difficulty making the distinction.

But I take your point.

---

From: Bernard Aboba <[email-masked]>
Date: Thu, 29 Mar 2012 16:03:20 +0200

While they would be perceived as different with first party IdP, a signed assertion is still meaningless without some proof that the E.164 number is actually owned by the domain making the assertion.

---

From: Martin Thomson <[email-masked]>
Date: Thu, 29 Mar 2012 17:17:18 +0200

> While they would be perceived as different with first party IdP, a signed assertion is still meaningless without some proof that the E.164 number is actually owned by the domain making the assertio…

Yes, if you infer that it is an E.164.  I wouldn't have inferred that
it was an E.164 number because I know that you can't make those sorts
of assertions - it's just a string @ a domain.