<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 9/23/15 5:07 AM, Rod Widdowson
wrote:<br>
</div>
<blockquote
cite="mid:002201d0f5df$4632f080$d298d180$@steadingsoftware.com"
type="cite">
<blockquote type="cite">
<pre wrap="">I guess there are enough cases where entities share certs that it could
provide some savings in the IdP on certain metadata sources.
</pre>
</blockquote>
</blockquote>
<br>
Honestly, I would have thought that, except for some testing
scenarios, not many entities would share certs amongst themselves.
But maybe I'm wrong. (unless you meant something else)<br>
<br>
<blockquote
cite="mid:002201d0f5df$4632f080$d298d180$@steadingsoftware.com"
type="cite">
<pre wrap="">
Notably the UKFederation metadata has (had?) many hundreds of IdPs like
that....</pre>
</blockquote>
<br>
Really?! I guess I'm missing a whole use case here...<br>
<br>
<br>
I did think of 2 very common metadata cases though where this
de-duplication really matters:<br>
<br>
1) Entities (really RoleDescriptor types) who use the same cert for
both signing and encryption, but express it with 2 distinct
KeyDescriptors with different 'use' attributes.<br>
<br>
2) IdPs with both an IDPSSODescriptor and an
AttributeAuthorityDescriptor which uses the same cert<br>
<br>
<br>
And probably lesser importance/impact: There are long-lived certs
sitting in metadata, and then you have short-lived signed and
encrypted stuff coming in at runtime in protocol messages, where the
message KeyInfo(s) naturally have certs which are duplicates of the
ones sitting in metadata. Probably not a lot of impact except on a
heavily loaded IdP with lots of signed/encrypted things coming in
simultaneously with the same cert data. But might reduce some
growth of the heap and the associated garbage collection.<br>
<blockquote
cite="mid:002201d0f5df$4632f080$d298d180$@steadingsoftware.com"
type="cite">
</blockquote>
<br>
</body>
</html>