Re: [radext] CUI comments in "deprecating insecure transports"

[Margaret Cullen <[e-mail]>]

Hi Josh,

> On Jul 26, 2023, at 5:58 AM, [e-mail] wrote:
> There are good reasons for the CUI value to be persistent, provided that it
> is targeted to each network access provider. In this way, different
> providers cannot collude to track users. However, they still maintain the
> ability to *recognise* (but not identify) the same user that they saw earlier

I understand the value of using a single, unique CUI per user/service provider pair in application-level authentication, because the user may have persistent data or state associated with previous application sessions.

The current document text claims that a persistent CUI across sessions  is not needed for network access.  Do you think there is per-user state that might be maintained by the access provider across sessions, requiring a persistent CUI?  

If so, we might want to say that the CUI MUST be unique per user/access provider pair, rather than unique per-session.

In either case, the IDP can store the user<->CUI mapping for later use, whether it is generated for each access provider or for each session, so that the user can be identified later, if necessary.

The important point is that the same CUI MUST not be sent to multiple access providers to identify the same user.  Hopefully we all agreed on that.

Margaret