Delegation vs. Validation

I picked up the following conversation at the end of last week's minutes.

On 14/02/2017 17:23, msporny@digitalbazaar.com wrote:
> Matt Stone:  It sounds like it's a blend of endorsement and 
>   delegation.
> Christopher Allen:  Maybe, you could say there's a third 
>   category. I directly absolutely control this data and this 
>   authority and then there's somebody I've given agency to do so 
>   and then there's just somebody that's validated it.

Delegation of authority from an authoritative source to a trusted
delegate is reasonably well understood and should be an explicit part of
our trust model. There are two alternative ways of performing DoA that I
know are currently used in practice today. Downwards delegation is the
most common one where the authoritative source delegates to subordinate
entities e.g. as practised by Visa credit cards issued via banks; and
Upwards delegation from authoritative sources to a trusted central
issuing authority e.g. the issuing of National Student Cards by the NUS
based on information provided by each UK university. These two models
have a direct effect on the way that: credentials are issued, inspectors
validate them, and the way that revocation information is dealt with.

Wrt to some third party that happens to have validated a claim and
issued its own credentials which certain inspectors trust, then the
trust model can also handle this, but I don't actually see how it
differs from an authoritative source issuing credentials.

regards

David

Received on Tuesday, 21 February 2017 12:42:57 UTC