Per-Entity Metadata Working Group

[Scott Koranda <>]

> > Are there other arguments in favor?
> 
> The generic one is just to limit the chance of a stale
> result being injected into the stream. Without real time
> signing, you don't have much of a freshness guarantee, so
> there are still windows during which stale metadata
> responses could be injected. XML Signature doesn't natively
> have properties related to replay or freshness. Using TLS
> raises the bar for that attack, but less so if we're talking
> CDNs since that basically eliminates any real hope of
> verifying the TLS certificate at any strength.

Can you elaborate?

My naive understanding was that many of the commercial CDN
providers allow one to specify the X.509 certificate chain to
be used for TLS.

Am I wrong or missing the point or ?

Thanks,

Scott K