Re: Sub/Not Security, Presence service identifiers

"Adrian Bateman" <[email protected]> writes:

> Yes, I recognize the need to authenticate things as you say, but I
> couldn't find anything in the RFC's related to the presence service.

Mark Day located the relevant quote:

5.2.4 of RFC2779 says

   The protocol MUST provide means of protecting B from another
   PRINCIPAL C "spoofing" notification messages about B.

> In particular, there was consensus ages ago that we make sure there
> wasn't an advantage in running a local server as opposed to a client
> - this says to me that in some situations it would be the client
> that would provide presence information.

The authentication scheme I propose is neutral as to whether a client
or a server provides presence information.  For authentication, all
that matters is that the software that is providing presence service
has been given the right by a certificate authority to use the kind of
identifier that allows it to act as a presence service.

> Presence subscriptions must be authenticated to ensure that only the
> right people get to see my presence document. I can create different
> presence documents for different subscriptions. I send out notifications
> when my presence document changes. One might think that the document
> would be created at that time by the client.

I agree we must one day provide subscription authentication, but I
think there is a consensus to address notification authentication
first.

> If a presence service is in some way responsible for generating my
> presence document based on some property such as a TCP/IP connection,
> should it not have the responsibility for my presence URI, and hence for
> being able to sign on my behalf?

It depends on what you mean by the phrase "sign on my behalf".  If you
mean that a presence server should share your private key so that it
can sign documents as if it were you, this would be very bad.  A
private key should be used only by one subject.  Few security
conscious sites would allow private key sharing.

Maybe you mean that a certificate authority has issued a presence
server certificate that corresponds to your presentity.  That
certificate authority gave the presence service authorization to sign
notifications about your presence information.  In effect, the
certificate authority gave the presence service authorization to sign
on your behalf.  This is exactly what I had in mind.

> 
> Adrian.

John



  [reminder: [email protected] for non-technical discussions, please]