Re: Sub/Not Security, Presence service identifiers

"Adrian Bateman" <[email protected]> writes:

> I really really must make time to read through the latest drafts to
> ensure that I am up-to-date, but in the interests of discussion, I want
> to ask the following question - if this is covered somewhere, please
> excuse me and point me to the appropriate text.
> 
> My understanding of the requirements was that we are aiming for
> end-to-end security. Wouldn't this mean that I would expect to receive a
> presence document signed by the principal rather than one signed by some
> arbitrary presence service address?
> 
> Adrian.

When receiving a notification, a watcher would like to know that the
presence service that is sending the notification is authorize to do
so on behalf of the person that provided presence information.
Without the authentication of the presence service, a watch could be
spoofed into receiving presence information from an invalid source.

Signing the presence information by the person that created it does
not fix the problem, because a spoofing presence service could collect
signed presence information and replay them in an order that
misinforms the watcher.  In addition, in some systems, a presence
service generates the online information in a presence information
document based on whether there is an open TCP/IP connection to the
person's client.  In these systems, only the presence service can sign
all of the presence information, because the person does not
contribute the online status elements.  

One final point, I believe there is an explicit requirement in one of
the RFC's that says a watcher has to be able to authenticate a
presence service.  I'm too lazy to look it up now.

John




  [reminder: [email protected] for non-technical discussions, please]