> Could you provide a motivating example for which assigning
> each TAA scope to a separate trust store is not a good solution?
Many trust stores are used by a variety of applications that serve a variety of purposes. Using multiple trust stores as the mechanism for supporting different purposes is certainly possible, and could be implemented even if there were a mechanism that enabled multiple TAAs with different privilege sets to manage a single trust store.
I'm not sure we need to settle on a mechanism right now. There's no disagreement that multiple TAAs serving different purposes are necessary for some devices.
> Steve's example didn't do it for me, as I think it only requires
> 4 trust stores, one of which does some extra certificate checks.
>
> To explain where I'm coming from - my default hypothesis (I'm
> definitely prepared to be proved wrong) is that most of the
> scope, policy, etc. features can be handled via certificates,
> possibly cert extensions of some form. I'd prefer to deal
> with this area in that fashion, even to the point of having
> the TSA that is used to authorize the TAA include a
> certificate with whatever extensions are needed to get the
> job done. If existing certificate technology can be reused,
> we don't have to reinvent it, simplifying things for all concerned.
I agree, though processing extensions from certificates that function as TAs would require augmentation of the 3280 path processing algorithm.
> Thanks,
> --David
> ----------------------------------------------------
> David L. Black, Senior Technologist
> EMC Corporation, 176 South St., Hopkinton, MA 01748
> +1 (508) 293-7953 FAX: +1 (508) 293-7786
> black_david@xxxxxxx Mobile: +1 (978) 394-7754
> ----------------------------------------------------
>