Subject: Re: [TLS] [foaf-protocols] foaf+tls for distributed social networks - 2 questions

From: Henry Story <[email-masked]>
Date: Tue, 03 Mar 2009 22:21:27 +0100

On 27 Feb 2009, at 12:08, Nikos Mavrogiannopoulos wrote:

> Henry Story wrote:
>> Dear TLS experts,
>>
>> We are working on a very simple protocol for distributed identity  
>> in a
>> web of trust that uses TLS in a novel way. The details of this are  
>> short
>> and can be found online [1]. Here I'd first just like to ask two
>> questions, to get into the heart of the problem, then I'll explain  
>> why
>> these came up.
>
> After the explanation and seeing the protocol description I still do  
> not
> understand why you need the client certificate for what you want to
> achieve. Why you don't send the information you need for foaf on the
> application layer (if it is http via a cookie etc)? Why send a dummy
> certificate and add some extensions on it? Also the security offerings
> are not clear to me. What will that protocol offer, security-wise?

I wrote up another post that may help answer some of these questions  
after some very interesting discussions on the foaf-protocols mailing  
list.

"The foaf-ssl paradigm shift"
http://blogs.sun.com/bblfish/entry/the_foaf_ssl_paradigm_shift

I'd be very interested to know if that helps make things clearer, if  
you agree, if there are things I missed there?

Henry

> regards,
> Nikos
> _______________________________________________
> foaf-protocols mailing list
> [email-masked]
> http://lists.foaf-project.org/mailman/listinfo/foaf-protocols