InCommon metadata support

[Tom Scavo <>]

On Wed, Dec 7, 2016 at 5:22 PM, Tom Poage 
<>
 wrote:
>
> My off-the-cuff thoughts, right or wrong, aside

Actually, your analysis is very thorough and your questions are right
on. I'll resist the urge to answer each one, and instead try to answer
your last question:

> what precisely does TLS get us, in addition to XML encryption, to improve 
> the management of risk?

TLS and XML encryption are two completely different things. If I may
interpret your intended question, I think you're asking about the
benefit of TLS given the fact (as you noted) that confidentiality is
not a requirement. In any case, that's the question I'll try to
answer.

There are two use cases, and hence two answers. If you're doing the
Right Thing, there's one answer; if you're doing the Wrong Thing,
there's a different answer.

If you're verifying the signature on the file, you're doing the Right
Thing. In that case, TLS yields marginal benefit since (as you pointed
out) a man-in-the-middle is limited in what it can do.

If you're NOT verifying the signature on the file, you're doing the
Wrong Thing. All of us should be concerned about deployers who are
doing the Wrong Thing. A trustworthy federation depends on its
deployers doing the Right Thing.

I have reason to believe there are many deployers who are doing the
Wrong Thing. As a federation operator, I am focused on that group of
deployers. I need to do what I can to coerce them (if necessary) to do
the Right Thing. If I can do that, everyone will benefit.

Deploying commercial TLS on the metadata server will not convert
deployers who are doing the Wrong Thing. Indeed, I claim that
commercial TLS will increase the number of deployers who are doing the
Wrong Thing since many deployers naively think that HTTPS is some kind
of silver bullet. My fear is: New deployers will configure their
clients for HTTPS and intentionally ignore the signature. In which
case, as a federation, we'll be worse off than we are now.

So there is no single answer to your question. A deployer who is doing
the Right Thing will tend to favor commercial TLS since that's the
easiest way to eliminate the man-in-the-middle. OTOH, what about the
deployer who is doing the Wrong Thing?

I won't try to answer that rhetorical question but that IS the
question I care about. I am keenly focused on the deployer who is
doing the Wrong Thing.

Tom