RE: On the need for presence service identifiers

On 20 August 2002 20:30, John D. Ramsdell wrote:
> This exchange on presence service identifiers should be taken as a 
> warning on the dangers of considering notification authentication 
> without thinking about subscription authentication.  Had I focused 
> only on notification authentication, my argument for a presence 
> service identifier would have centered around the fact that a lack of 
> one implies that a signing presence service would be required to 
> maintain a private key for each user of its service.  Obviously, a 
> design that requires this is bogus.  Can you imagine AOL's AIM servers

> maintaining that many private keys?
> 
> The case becomes even stronger, however, when one considers 
> subscription authentication.  In this case, duplicate, but matching 
> certificates and their private keys must be maintain in different 
> locations.  Only when one considers subscription authentication does 
> the logistics nightmare become evident.

(Note that to a degree, I'm playing devil's advocate here in the
interest of the discussion - I see some merit in your proposal, but I'm
not yet convinced that it is the only solution.)

If the presence service is acting with authority on behalf of the
principal in the signing of presence notifications, why could it not do
the same thing for subscriptions? In essence, we are saying that this
presence service is acting as a presence proxy on behalf of the
principal.

As far as AIM, etc., well, ubiquitous PKI is expensive which is why it
hasn't happened yet and won't soon IMO. It is expensive in terms of
knowledge, resources, etc. etc.

Adrian.