InCommon Operations Notifications

[Nick Roy <>]

Hello,

InCommon metadata is now available over TLS (https://).  More info is
available on the Metadata Aggregates [1] wiki page.  You may recall that
I recently said we would never publish metadata over TLS [2].  That blog
post caused several people to come forward and make a case for the
ability to download metadata over TLS.  In some cases, the reasons for
this involve data center firewall policies for outbound traffic.  In any
case, we *strongly* encourage those that can download metadata via
plaintext and then verify the signature on the metadata per [3] to
continue to do so.  TLS is not a sufficient security measure to ensure
that metadata, which carries the public keys that the federation trust
relies upon, is not tampered with.  Only verifying the signature on the
metadata each time it is downloaded achieves the required level of trust.

Best Regards,

Nick Roy
Director of Technology and Strategy, InCommon / Internet2 Trust and
Identity Services

[1] https://spaces.internet2.edu/display/InCFederation/Metadata+Aggregates

[2] https://www.internet2.edu/blogs/detail/14522

[3] https://spaces.internet2.edu/display/InCFederation/Metadata+Consumption