What use is SenderVouches? (was RE: [security-bindings] SOAP Prof iledraft)

[Irving Reid <Irving.Reid@baltimore.com>]

The new SOAP profile draft that Prateek sent out
(http://lists.oasis-open.org/archives/security-bindings/200110/msg00017.html
) contains a variation on Bob Blakley's "SenderVouches" method for
<SubjectConfirmation>.

I still don't see what the value of this is. As far as I can tell, when an
issuer creates an assertion containing
<SubjectConfirmation>SenderVouches</SubjectConfirmation>, what they are
saying is:

The way you can tell if this assertion applies to a given message, is that
the sender of the message attached this assertion to the message.

In other words, the assertion applies to the message because the sender says
so. Presumably, the sender attached the assertion to the message because the
sender intended to indicate that the assertion is relevant to the message.

Now, what does it mean for a sender to attach an assertion to a message,
when the assertion in question is _not_ marked SenderVouches? I argue that
it means exactly the same thing: the sender attached the assertion to
indicate that the assertion is relevant.

I can't think of any circumstance where the SenderVouches marker actually
adds value. I think it should be dropped.

 - irving - 


-----------------------------------------------------------------------------------------------------------------
The information contained in this message is confidential and is intended 
for the addressee(s) only.  If you have received this message in error or 
there are any problems please notify the originator immediately.  The 
unauthorized use, disclosure, copying or alteration of this message is 
strictly forbidden. Baltimore Technologies plc will not be liable for direct, 
special, indirect or consequential damages arising from alteration of the 
contents of this message by a third party or as a result of any virus being 
passed on.

In addition, certain Marketing collateral may be added from time to time to 
promote Baltimore Technologies products, services, Global e-Security or 
appearance at trade shows and conferences.
 
This footnote confirms that this email message has been swept by 
Baltimore MIMEsweeper for Content Security threats, including
computer viruses.