Re: On the need for presence service identifiers

I've been quietly listening to (and learning from) this conversation. But I can't resist chiming in at this point. Below...

	Paul

"John D. Ramsdell" wrote:
> 
> Let me rephrase my question.  A PRINCIPLE, in this case a person, uses
> a PRESENCE USER AGENT to sign and deliver presence information to a
> PRESENTITY.  The PRINCIPLE's private key used for signing is on the
> same laptop as the PRESENCE USER AGENT.  The PRINCIPLE goes away for a
> week, and takes the laptop.  The PRESENCE USER AGENT is no longer able
> to sign presence information updates.
> 
> > In particular, I can't tell whether you're concerned about principals or
> > presentities going away.
> 
> I am concerned about a PRESENCE USER AGENT, which has access to a
> private key, going away.  As near as I can tell, a PRESENCE SERVICE
> can combine a set of PRESENTITY's within an implementation, so saying
> that a PRESENTITY will sign PRESENCE INFORMATION can be interpreted as
> saying that a PRESENCE SERVICE will sign.  But you excluded the idea
> that the server is signing.

In general there may well be several PRESENCE USER AGENTs delivering presence user information to the same PRESENTITY. (A PC, PDA, office phone, home phone, cell phone, ...) In that case a signature over any of those individual pieces of presence information isn't very useful, and probably won't be delivered to a WATCHER. Instead, the PRESENTITY must authenticate the presence info it receives from each PRESENCE USER AGENT, consolidate that information into a single set of presence information, and then sign that on behalf of the PRESENTITY as a whole.

The PRESENTITY could be collocated with a PRESENCE USER AGENT, or it could be collocated with the PRESENCE SERVER, or it could be someplace else. But it is a bad thing for it to be collocated with one PRESENCE USER AGENT that might become unavailable while other PRESENCE USER AGENTs are still delivering information for the same PRESENTITY. Hence in many cases it may be unwise to collocate a PRESENTITY with a PRESENCE USER AGENT. Wherever it it, it seemingly requires a private key for the PRESENTITY, which may or may not be the same as the key for any of the PRESENCE USER AGENTs - probably different unless the PRESENTITY is collocated with the PUA.

(I don't think it is sufficient to use a shared key, say for the PRESENCE SERVER, to sign the consolidated presence information from several PRESENCE USER AGENTs.)



  [reminder: [email protected] for non-technical discussions, please]