Subject: [xmpp] Brief thought on draft-ietf-xmpp-dna

From: "Richard L. Barnes" <[email-masked]>
Date: Tue, 29 Jun 2010 17:29:08 -0400

Regarding section 6.5:

Would it be easier here just to provide a pointer to the certificate?   
You could:
1. Point to an application/pkix-attr-cert object with just the  
attribute cert
2. Point to an application/pkcs7-mime object with all the certs
3. Provide separate pointers to attribute cert and trust chain, or  
individual certs

It's not a huge difference here (downloading in XMPP vs. something  
like HTTP), but doing things by reference could work much better for  
other future uses of these attribute certs.  I'm imagining something  
like a Delegation header for HTTP or SIP where a URI could easily go,  
but a whole base64-encoded cert would be a little clumsy.