Re: [Secret] BoF Follow-up on charter definition

[Michael Richardson <[e-mail]>]

Matthew Byington <mbyington=[e-mail]> wrote:
    > There are many situations in which it is desirable to share a digital
    > credential with another person. For example, you may want to provide
    > access to your vehicle to a friend or a family member. You may also
    > want to provide access to your home to your cat sitter. Or, you may
    > want to share a hotel key with your spouse. Today, no such standardized
    > method exists in a cross-platform, multidisciplinary capacity.

I still have no idea what it is that we need to share.
It still reads like it's a private **key** to me.

I would love to be able to share a digital hotel key without the hotel's
permission, but I just don't believe that is a real use case today.
For the car, I fear that the car maker is also involved.
I know of no home locks that offer any kind of delegated authorization that
does not require a cloud interface, but I'd sure like a counter-example.

But, if we are dealing with an access/authorization that provides for
delegation, then the digital statement is some kind of document signed by a
key.
It needs privacy because of eavesdroppers, but not because there is a private
key involved.

I think it is critical that the charter include some references.
Maybe it would start with:

  "When digital credential systems such as XXX, YYY, ZZZ are used
  to provide authorization to devices like home door locks, hotel door locks,
  or ignition systems for vehicles, there are often situations where it
  is useful to be able to delegate authorization to another person."

While it is claimed that we don't need to know anything about the systems
involved, and reading about the mailboxes, etc. I can see how that appears to
be the case.  But reading those details re-inforces for me, the view that we
are sharing a private key.

This is one reason I don't think we can start with the proposed ID.
(And as Klensin said: I'm not quite sure why SMTP + SMIME wouldn't be good enough)

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide