Subject: Re:Identity Firewall. l PKI International Consortium

From: [email-masked]
Date: Sun, 11 Apr 2004 08:02:28 -0600

i was at a presentation of a vendor SAML product about a year ago that was
being deployed in a number of institutions. the CTO was presenting all the
message flows. I made some comment that the message flows looked nearly the
same as a Kerberos presentation i had sat thru circa 1990. The response was
that there was just only so many ways that distributed security control
could be implemented.

anders rundgre wrote:

What Steve did not mention, is that the authentication and
authorization schemes that are firmly in place since three
decades or so for bank-to-bank and supplier-to-manufacturer
networks, together with recent developmemts like SAML and
3D Secure, will likely forever change how PKI is applied, which
also will affect schemes like the Identity Firewall.

--
Internet trivia, 20th anv: http://www.garlic.com/~lynn/rfcietff.htm

---

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 11 Apr 2004 17:22:32 +0200

>that there was just only so many ways that distributed security control

This is correct.  Same goes for 3D Secure which is really
very much a dedicated SAML.

What's making these schemes more powerful (in a web-
environment nota bene), than Kerberos is that they build on
XML allowing assertions of any size and semantics.  Web-
browser redirects and ECMA-script-driven auto-POSTs does 
the rest.

Now, what does this has to do with PKI and the Identity
Firewall?  Well, the 3D Secure and SAML credentials
are typically secured by signatures and certificates
operating at "business partner level".   Voila!
The same "level" typically used for leased lines in B2B networks.

The rest is for the PKI community to understand the huge
consequences of (and some day maybe take action on).

Anders

anders rundgre wrote: