Shibboleth Developers

["Scott Cantor" <>]

> I am probably going out on a limb here, but it strikes me as analagous
> to the way that we don't care about authentication of TLS connection
> peers in the front-channel bindings; these aren't part of the trust
> fabric that matters.

Off topic, but...

Cardspace apparently relies on blind, unauthenticated use of the RP's SSL
certificate to obtain the encryption key to use.

That was an idea I expected to be presented here in response to our proposal
that encryption support require using metadata-distributed keys. I don't
like it much, but I'm not surprised they're doing it.

-- Scott