Shibboleth Developers

[Jim Fox <>]

> Let me put it this way. If we have to think about this
> non-trivially, it's the wrong approach.

Possibly we can stop overdesigning this thing.  The whole point was
to give some uniqueness to infocard's broken PPID.  Adding a hash
of the card's public key accomplishes that.  The only reason the
original PPID might not be unique is that it is a bearer item, and
could be stolen and reused.  The only way the PPID can be discovered
is with the compromise of the user's system or the server's system.
Either way any little bit of security has been lost.

We don't even know that the key hash is even beneficial.
If I export a card to another system, the PPID might
stay the same, but will the public key?  I don't see where
that's guaranteed.  The system might be more useful without
it and no more secure with it.

My inclination is to drop the public key - hash and all.
If the PPID is important to the service, then the service
can protect it.

Jim