Re: [rtcweb] IdP in RTCWeb

Igor Faynberg <igor.faynberg@alcatel-lucent.com> Thu, 22 March 2012 18:18 UTC

Message-ID: <4F6B6CD6.2070801@alcatel-lucent.com>
Date: Thu, 22 Mar 2012 14:17:58 -0400
From: Igor Faynberg <igor.faynberg@alcatel-lucent.com>
Organization: Alcatel-Lucent
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.18) Gecko/20110616 Thunderbird/3.1.11
MIME-Version: 1.0
To: Eric Rescorla <ekr@rtfm.com>
References: <4F6B5FEE.9060706@alcatel-lucent.com> <CABcZeBPBac83KmE3we1nAV+eEusLrJbUij4DHmuCyDSkQ4fdVQ@mail.gmail.com>
In-Reply-To: <CABcZeBPBac83KmE3we1nAV+eEusLrJbUij4DHmuCyDSkQ4fdVQ@mail.gmail.com>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Cc: "rtcweb@ietf.org" <rtcweb@ietf.org>
Subject: Re: [rtcweb] IdP in RTCWeb
Precedence: list
Reply-To: igor.faynberg@alcatel-lucent.com

Thanks! Now I understand.

My only follow-up question (and that could probably wait until the next 
week) is why not make BrowserID certificate adhere to X.509.  If we 
issue self-signed X.509 certificates ourselves, what is in the way of 
any IdP doing just that?

Igor

On 3/22/2012 1:53 PM, Eric Rescorla wrote:
> Good question.
>
> 1. BrowserID certificates aren't X.509, and that's all the TLS/DTLS will do.
> 2. This lets us be agnostic about IdP mechanisms without having to change
> TLS every time we add a new one.
>
> -Ekr
>
>
> On Thu, Mar 22, 2012 at 6:22 PM, Igor Faynberg
> <igor.faynberg@alcatel-lucent.com>  wrote:
>> Eric,
>>
>> A question:  For the case of BrowserID, I understand that a client gets a
>> certificate from an IdP.   If so, why you and I would not use the
>> certificates from our respective IdPs in order to authenticate each other
>>   in DTLS?
>>
>> Igor
>>
>>
>>

[rtcweb] IdP in RTCWeb Igor Faynberg
Re: [rtcweb] IdP in RTCWeb Eric Rescorla
Re: [rtcweb] IdP in RTCWeb Igor Faynberg
Re: [rtcweb] IdP in RTCWeb Harald Alvestrand
Re: [rtcweb] IdP in RTCWeb Igor Faynberg
Re: [rtcweb] IdP in RTCWeb Ralph Giles