OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

security-services message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]

Subject: [security-services] ISSUE: Can the SenderVouches security model beexpressed without use of SenderVouches architecture?

[Blakely-WorkItems] proposes an extension of the SOAP profile as found in
bindings-05. The main idea in this architecture is that a subject may
a "trusted" sender with one or more SAML assertions; the sender then obtains
attribute assertion holding the senders public key. All of this material is
attached to a business payload via the senders signature (using the sender
[{[Assertions about Subject] [Assertion with Sender Public Key][Payload]}
A recipient can determine if the BusinessMessage has been tampered by
examination of [Signature]; establish
identity of the sender by examination of [Assertion with Sender Public Key]
and then
process the payload in context of [Assertions about Subject]. This model is
interesting when an end-user lacks private/public key pairs and utilizes a
trusted server
to securely attach assertions to a payload.
During the bindings con-call on Oct 11, it was suggested that this effect
achievable thru existing security infrastructure. Notice that the key issue
above is 
representing the
trust relationship between the sender and recipient. It was argued that 
[Assertion with Sender Public Key] is essentially equivalent  to a X.509
certificate and that the following message architecture is equivalent to the
 BusinessMessage= {[Assertions about
As before BusinessMessage integrity is guaranteed by the senders signature;
instead of processing [Assertion with Sender Public Key] the recipient
the [X509.Certificate] (this could be generalized to <ds:KeyInfo>) and
whether the sender is trusted to "vouch for" the subject.
Comments are invited on this proposed change.
- prateek

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]

Powered by eList eXpress LLC