Question on Trust Engine

[Cantor, Scott]

On 3/19/14, 12:50 PM, "CJ Binder" <CBinder at linoma.com> wrote:
>
>Then it refers to a section on Trust Engines that is incomplete.

Which leaves the javadocs and the code. If you're looking for more right
now, this isn't the library you want. Facts is facts, just being up front
about it.

>So with my current implementation using ExplicitKeySignatureTrustEngine
>and supplying a X509Certificate, is it truly establishing trust or is it
>just the same as if I didn't use the trust engine and is only validating
>the signature in which the documentation is misleading?

It's establishing trust if the key you are giving it is trusted. That is,
if you supply a key statically (which you are), then you are asserting
that the key is trusted for that signer, and the trust engine will ensure
that it was the key that signed.

This is useful for verifying certain kinds of documents, such as
federation metadata files that are signed with known keys. It is not
useful for SAML assertions (unless you have one peer).

In the real world, we use metadata to obtain those keys. But the trust
engine is unaware of where the keys come from, which separates the
question of how to use them from how to get them.

-- Scott