Subject: [rtcweb] IdP in RTCWeb

From: Igor Faynberg <[email-masked]>
Date: Thu, 22 Mar 2012 13:22:54 -0400

Eric,

A question:  For the case of BrowserID, I understand that a client gets 
a certificate from an IdP.   If so, why you and I would not use the 
certificates from our respective IdPs in order to authenticate each 
other  in DTLS?

Igor

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 22 Mar 2012 18:53:42 +0100

Good question.

1. BrowserID certificates aren't X.509, and that's all the TLS/DTLS will do.
2. This lets us be agnostic about IdP mechanisms without having to change
TLS every time we add a new one.

-Ekr

On Thu, Mar 22, 2012 at 6:22 PM, Igor Faynberg
<[email-masked]> wrote:
> Eric,
>
> A question:  For the case of BrowserID, I understand that a client gets a
> certificate from an IdP.   If so, why you and I would not use the
> certificates from our respective IdPs in order to authenticate each other
>  in DTLS?
>
> Igor
>
>
>

---

From: Igor Faynberg <[email-masked]>
Date: Thu, 22 Mar 2012 14:17:58 -0400

Thanks! Now I understand.

My only follow-up question (and that could probably wait until the next 
week) is why not make BrowserID certificate adhere to X.509.  If we 
issue self-signed X.509 certificates ourselves, what is in the way of 
any IdP doing just that?

Igor

---

From: Harald Alvestrand <[email-masked]>
Date: Fri, 23 Mar 2012 12:22:42 +0100

On 03/22/2012 07:17 PM, Igor Faynberg wrote:
> My only follow-up question (and that could probably wait until the 
> next week) is why not make BrowserID certificate adhere to X.509.  If 
> we issue self-signed X.509 certificates ourselves, what is in the way 
> of any IdP doing just that?
The BrowserID specification is the work item of a group that is entirely 
outside of this group.
You can certainly go there (browserid.org) to argue that they should 
change to X.509 certificates, but we can't decide in the RTCWEB WG that 
they should change.

>>> other
> _______________________________________________
> rtcweb mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rtcweb
>

---

From: Igor Faynberg <[email-masked]>
Date: Fri, 23 Mar 2012 14:53:42 -0400

Now I understand  and agree that we cannot change their specification.  
But... do we need to use it?

Igor

On 3/23/2012 7:22 AM, Harald Alvestrand wrote:
> The BrowserID specification is the work item of a group that is 
> entirely outside of this group.
> change to X.509 certificates, but we can't decide in the RTCWEB WG 
> that they should change.
>
>>
>> Igor
>>

---

From: Ralph Giles <[email-masked]>
Date: Fri, 23 Mar 2012 18:32:53 -0700

>  But... do we need to use it?

We intend to use it in Firefox.

 -r