RE: [security-services] Suggest adding IssueInstant attribute toRequest and Response

[Hal Lockhart <hal.lockhart@entegrity.com>]

Title: RE: [security-services] Suggest adding IssueInstant attribute toR equest and Response

It is not my intention to browbeat you on this point. (everybody stop laughing) As I said orginally, I don't object to this element, but I want to make sure I know how it should be used to defeat attacks. This requires knowing what the attacks are.

Documents like the core specification are about generalization and extensibility.

Security considerations has to be about nitty gritty details.

An example that comes to mind is the situation where you can have two Public Key-based protocols which are each completely secure on their own, however if used together with the same key pair, they are completely broken.

Hal

> -----Original Message-----
> From: Scott Cantor [mailto:cantor.2@osu.edu]
> Sent: Wednesday, January 16, 2002 3:35 PM
> To: 'Hal Lockhart'
> Cc: 'SAML'
> Subject: RE: [security-services] Suggest adding IssueInstant attribute
> toR equest and Response
>
>
> >I don't understand this. You were able to capture the
> orignal request,
> but
> >you could not see the response?
>
> Not likely in the case of HTTP, but I suppose its more possible with
> something like SMTP where there's a time delay.
>
> More likely you can capture the original response too, but
> now you have
> a lifetime pass (modulo the signing certificate expiring) to get the
> latest attributes (as Alice) any time you want them.
>
> It's becoming apparent to me that this case is of sufficiently limited
> scope for the current SAML exchanges that nobody is going to
> worry much
> about it, and I can live with that. I still don't see much of a cost
> here, but I understand now why it's not in there.
>
> -- Scott
>