Re: Call for objections: subscription/notification security

I have some concerns about this work moving forward.

First off, authentication of subscriptions is something that I suspect 
will not realistically happen with PKI signatures. The amount of cases 
where users have public keys are small. The exception are probably 
enterprises that deploy PKI internally. Since we are talking about CPIM, 
we are talking about inter-protocol, and therefore, likely interdomain. 
The odds that a user in one domain has a cert verifiable by someone in 
another domain is really small. Practically speaking, I suspect that 
transitive trust will be the only realistic solution for authentication 
of subscriptions inter-domain. Since that is fundmanetlaly a hop-by-hop 
model, it is handled by the IM&P protocol, not CPIM.

This is much different from notifications, where I expect the presence 
service to sign the presence document. Therefore, having a signed 
notification is useful, and this is what CPIM provides.

Generally, CPIM has been going for a minimalistic approach, 
incorporating what is minimally required for interoperability across 
protocols. The bar, IMHO, is therefore high to add new functionality. 
Certainly that has been the case for our work to date. The amount of 
stuff we tossed out of PIDF is arguably much larger than whats in there 
now....

Finally, this group needs to finish. We've already been suffering 
because of constantly changing documents and formats over a long period 
of time. Indeed, as you know MS shipped windows with an old version of 
the PIDF specification. I would much rather finish what we have now, and 
then revisit the need for this down the road.

Thanks,
Jonathan R.

Derek Atkins wrote:
> * places WG co-chair hat on head *
> 
> Over the past month or so I've seen a lot of discussion about
> end-to-end security (which implies standarding formats) for
> subscription and notification messages.  Most of the discussion that
> I've seen has been positive and/or technical tweaks to hone the
> proposal.  I have seen no objections.  Mark and I, as co-chairs, are
> currently deciding whether to add this as WG work items.  Therefore,
> I'd like to ask the working group for your positions on this work:
> 
>         1) Should we be standardizing subscription and notification
> formats?
>         2) Is the current proposal sufficient?
> 
> If you have objections to the working group moving forward on this
> technology, I suggest you email your objections to the list.
> 
> Thanks,
> 
> -derek, your impp co-chair
> 
> * hat gracefully removed *
> 


-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email protected]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com




  [reminder: [email protected] for non-technical discussions, please]