Re: [Secdispatch] Requesting agenda time for draft-halen-fed-tls-auth

[Stefan Halen <[e-mail]>]

 > But as I understand this design, you in fact have a PKI, it's
 > just that it's carried in a single JWS-signed metadata object
 > rather than in X.509 certificates. This seems less flexible,
 > so it's not clear to me what the advantage of this design
 > is.

The metadata is also used for discovery. The client normally select a
server based on metadata claims (e.g., organization, tags). The client
connects to the server's base_uri, also found in metadata.

The federation operator must keep track of the members and which
combinations of tags and peer type each member may publish.

To enable self-signed certificates, there is the possibility of
publishing issuers.

Issuers are for reverse proxys that do not support optional_no_ca. Pin
validation is performed by the application

 > This needs considerably more detail about how it is used
 > in practice. Specifically, it's not clear to me what
 > the reference identity is that I am supposed to compare
 > the pins to. I.e., if I think I am connecting to a given
 > domain name, which is the common practice, how do I look
 > that up in the metadata?

In this federation, clients will only connect to services with which
they have a business relationship (i.e, discovery by organization and
tags).


Thank you for the input!

Regards
Stefan