Metadata Distribution Subcommittee of TAC

[Ian Young <>]

On 12 Jul 2013, at 12:21, Tom Scavo 
<>
 wrote:

>> eduGain: Uses a self-signed cert to sign their MD. Online signing. Don't
>> know about their security implementation (HSM, etc).
> 
> Recalling the discussion, the above "facts" are mostly speculation.
> Maybe someone will take an action item to obtain authoritative answers
> to these questions?

It's a peripheral discussion, but just for the record I validated all of 
those things.

* Self-signed cert was included in a previous post to this list.

* The MDS deployment signs on-line.

* There is no HSM of any kind.

Tomasz is considering some steps to beef things up a bit in this area, but 
that's probably too speculative to be of value here.

        -- Ian

Attachment: smime.p7s
Description: S/MIME cryptographic signature