[Geopriv] consensus call: authenticated and asserted identities

hi all, 

as raised in a recent discussion about the xml schema of the
common-policy document there might not be a desire to differentiate
between authenticated and asserted identity. 

background:
-----------

we used the term authenticated identity if the policy server PS itself
verified the identity of the watcher/recipient (WR) (typically using
cryptographic means).

we used the term asserted identity if the policy server PS verified that
the WR was authenticated by another party (PS would have to trust the
other party). as an example, the identity enhancements described in RFC
3325 would fit into this category. the PS only gets the assurance that
another party performed the authentication. 

if a rule cannot distinguish between these two concepts then the rule
make implicitly needs to trust the parties trusted by the policy server.

question: 
---------

should we combine the concepts of authenticated and asserted identities
(and therefore avoiding a differentiation between them)?  

ciao
hannes

_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www1.ietf.org/mailman/listinfo/geopriv