Subject: [KEYPROV] Linking DSKPP to a Browser

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 6 Aug 2008 19:00:39 +0200

Although browser-based operation never were a KEYPROV requirement, it is quite possible that successful adoption will introduce such
demands.
I have played a little bit with the alternatives and I wonder if you have any comments to this document:

http://webpki.org/papers/web/XMLBrowserExtensionScheme.pdf

Regards
Anders Rundgren

_______________________________________________
KEYPROV mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/keyprov

---

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Thu, 7 Aug 2008 09:29:47 +0300

Interesting that you mention this since I thought the trigger message in
DSKPP was indeed meant to be used in a browser based application since
you cannot just send a message to a host given firewalls, NATs, and the
basic question of where to address the message in the first place 

So, what would prevent me from returning a MIME body of the type
"application/vnd.ietf.keyprov.dskpp+xml" in an HTTP interaction and then
allowing the browser to initiate the full DSKPP exchange? 

Ciao
Hannes

>-----Original Message-----
>From: [email-masked] 
>[mailto:[email-masked]] On Behalf Of ext Anders Rundgren
>Sent: 06 August, 2008 20:01
>To: KEYPROV
>Subject: [KEYPROV] Linking DSKPP to a Browser
>
>Although browser-based operation never were a KEYPROV 
>requirement, it is quite possible that successful adoption 
>will introduce such demands.
>I have played a little bit with the alternatives and I wonder 
>if you have any comments to this document:
>

---

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 7 Aug 2008 12:24:12 +0200

Hi Hannes,
As I wrote in the referenced paper, the scheme you describe is just one
out of five (by me) known ways linking an application to a browser.
Currently the MIME-way of doing things is probably the most
complicated to implement although it [IMO] is superior to the
more commonly used alternatives.

For mobile browsers the outlook seems even more bleak which
was the primary motivation for the write-up.

I.e. there is no free lunch in sight as far as I can see :-(

Regards
Anders

----- Original Message ----- 
From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
To: "ext Anders Rundgren" <[email-masked]>; "KEYPROV" <[email-masked]>
Sent: Thursday, August 07, 2008 08:29
Subject: RE: [KEYPROV] Linking DSKPP to a Browser

Ciao
Hannes

---

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 9 Aug 2008 08:52:33 +0200

An issue I forgot to mention is that protocols evolve making
a MIME-extension insufficient as a sole indicator of content.

OASIS/Liberty realized this and provided the following solution:

GET /index HTTP/1.1
Host: identity-service.example.com
Accept: text/html; application/vnd.paos+xml
PAOS: ver='urn:liberty:paos:2003-08' ; 'urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp'

This is IMO a rather specific way of doing things.
Bringing out the entire URI-stock you have in every HTTP request seems like a bad idea.

BTW, few if anybody supports the OASIS extension.

Basically we need another way of doing browser invocation that
scales better and that has a chance of getting universal support.

I took a stab at such a solution in the document I sent a link to.
I intend to make an open source implementation of this if I find
the time to do it.  If anybody is interested in creating a universal
solution for security (and other) protocol invocations in browsers
don't hesitate contacting me.

Anders

----- Original Message ----- 
From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
To: "ext Anders Rundgren" <[email-masked]>; "KEYPROV" <[email-masked]>
Sent: Thursday, August 07, 2008 08:29
Subject: RE: [KEYPROV] Linking DSKPP to a Browser

Ciao
Hannes