Re: [saag] IETF 93 Agenda Request - Key Discovery

[Richard Barnes <[e-mail]>]

On Thu, Jul 23, 2015 at 2:45 PM, Russ Housley <[e-mail]> wrote:
>
>>>> However, do not confuse RFC 7565 "acct:" URIs for email addresses.
>>>> Yes, they look a lot like an email address, as a "xmpp:" or "sip:" URI
>>>> can look a lot like an email address.  The "acct:" URI is for a
>>>> generic account identifier; it could be a placeholder to email, IM,
>>>> VoIP, filesharing, etc.
>>>>
>>>> My draft is intended for more than email.
>>>
>>> A major difficulty is that email addresses and "accounts", are not
>>> necessarily in one to one correspondence or even "few to one"
>>> correspondence.
>>
>> This doesn't actually matter.  WebFinger lets you put any URI in the
>> "resource" field.  So just use a "mailto" URI if you're sad about
>> "acct".  The document should probably say that, and probably say you
>> should return the same thing in either case.
>
> RFC 4387 provides a means to find an X.509 certificate using HTTP.  It seems pretty straightforward.  Do we have any running code for it?

With that "uri" attribute, it would probably be OK.  It would need
some more definition.

I suspect, though, that you're going to have applications that don't
want a cert, they want a key.  I think JWK strikes the right balance
here by providing the cert as metadata attached to the key.

--Richard


>
> Russ
>
>