On the need for presence service identifiers

Let me clarify the example I provided that demonstrates a situation in
which it is important that each presence service has an identifier
that distinguishes it as a presences service.  In this example, a bad
guy that is not approved to behave as a presence service, is
fabricating presence information in an effort to spoof a watcher into
using the wrong inbox for instant messaging.  The bad guy is creating
presence information and signing it, so timestamping will not foil
this attack.  Imagine that the subject that pres:[email protected]
identifies is a good and honorable MITRE employee who has had their
laptop stolen.

Here is the scenario.  Suppose you know my presentity is available at
pres:[email protected].  You subscribe to it by doing a DNS lookup of
mitre.org and say the APEX protocol to get a port and an Internet
Protocol address of the presence service providing my presentity.
Because the request was routed through a subverted host, you receive
two signed notifications back immediately, one that looks like:

         Content-type: Message/CPIM
 
         To: pres:user@host
         From: pres:[email protected]
         Datetime: 2002-07-18T13:38:22-8:00
 
         Content-type: application/cpim-pdif+xml	
 
         <presence entity='pres:[email protected]>
           <tuple id='im'>
             <status><basic>open</basic></status>
             <contact>im:[email protected]</contact>
           </tuple>
         </presence>

and the other one looks like:

         Content-type: Message/CPIM
 
         To: pres:user@host
         From: pres:[email protected]
         Datetime: 2002-07-18T13:37:29-8:00
 
         Content-type: application/cpim-pdif+xml	
 
         <presence entity='pres:[email protected]>
           <tuple id='im'>
             <status><basic>open</basic></status>
             <contact>im:ramsdell@badhost</contact>
           </tuple>
         </presence>

Both notifications are signed and include a certificate with the
presence URI in the 'From' header in its Subject Alternative Names.
Which instant inbox are you going to use?

One way to correctly answer this question is to use the convention
that a PRES URI's identifies a presence service if and only if it's
local part is the string "notifier".  Of course, there are other
conventions that can be used to distinguish presence service
identifiers.

John




  [reminder: [email protected] for non-technical discussions, please]