Shibboleth Developers

["Scott Cantor" <>]

> Sorry, I missed out my assumption that you'd be authenticating the
> *source* of the public key.  Obviously if you don't do that you're in
> trouble.

I guess maybe I mistook the intent to *be* the means of authenticating the
source in some manner. Specifically in conjunction with "I know I'm
accessing the SP's metadata endpoint". That has lots of holes due to lack of
transport authentication of course.

> The question is whether if you *are* authenticating the source
> of the public key, adding PoP on top gives you anything you need (in the
> context of people handing a federation operator a public key to be
> embedded in metadata).

No, then it amounts to saying your authentication itself is broken, as the
paper implies.

Of course, doing no authentication at all is analagous to an SSH or OpenID
model of just registering anybody with a key and then just making sure they
keep using that key. It is obviously the case that this was one of the use
cases behind the handler.

-- Scott