RE: [xri] subject sets (also sort of: Agenda for August 6, 2009 call)

["Scott Cantor" <cantor.2@osu.edu>]

Will Norris wrote on 2009-08-06:
> John Bradley, Nat Sakimura, and myself were present on the call.  So
> perhaps this will be a lesson in what happens when folks don't show up
> on the call :)

It's a pretty late call for me, so I tend to forget if I don't see an
agenda. But I did just flat out forget.

> First, in the PKI trust model, a consuming applications trusts the
> signature of an XRD if:
>   - the signature is valid for the document (of course)
>   - the certificate was issued by a trusted certificate authority
>   - the subject of the certificate matches the authority of the XRD
> Subject URI

That third item is still very underspecified, IMHO. Are you talking about a
hostname match? What if the URI in the subject isn't http/https and has no
hostname?

And why do I have to sign with a certificate containing the same
"authority"? What if I want a third party to sign it?

This is not something I understood to be an assumption of XRD. The subject
of a certificate is only *that*. It's about the entity possessing the key.
That should be orthogonal to the XRD Subject.

What I'm trying to say is that "PKI trust model" means nothing more or less
than "I have a model for establishing a relationship between the XRD signer
and the XRD subject, and a way to establish the validity of the signer's
key". I don't think it's right to bake more into it than that.

> I know that it is (or should be) a requirement that the XRD Subject
> have the same authority as the resource URI used to discover the XRD,
> since anytime you pass between authorities you need some kind of
> Signature (this was the whole argument for using XRD for host-meta in
> the first place).

Same question about "authorities". What is that term referring to in
general?

> None of the three of us on the call could remember whether it was
> required that the resource URI used to discover the XRD be referenced
> in the XRD itself.  John was under the impression that this is not
> required.  I honestly couldn't remember.  So that's something we
> definitely need to establish.  Is that something we had intended all
> along?  Does it make sense to require this?  What's the risk if it's
> not part of XRD Trust?

I don't see how you avoid this requirement. If a bunch of XRDs are signed by
some common authority, how would you know which one is really about your
resource?

-- Scott