Subject: [Anima-bootstrap] Does discovery include the domain?

From: "Michael Behringer (mbehring)" <[email-masked]>
Date: Tue, 8 Nov 2016 14:29:41 +0000

From "Re: [Anima-bootstrap] Detailed BRSKI review, part 1", Max' email from 20 Oct: 

> > In the reference model we state that if a pledge has been rejected by a
> domain, it should preferably use other domains that are seen. We may want
> to add something at the end of 3.1.1. This is also the reason why the pledge
> needs to know if the Registrar has rejected it based on MASA input.
> 
> CONCERN: Discovery doesn’t include a secure statement of the domain
> identity. So this behavior would imply something like “if the TLS
> authentication results in a domain that has explicitely rejected the Pledge
> previously then the attempt immediately fails and no request is initiated” in
> section 5?

Not straightforward. Up to now the pledge only knows it's rejected, not why. So this goes back to the discussion about a feedback to the pledge, which, as MichaelR pointed out, is not easy. But I think we need to be clear about it. 

We agree that "discovery doesn't include a *secure* statement of the domain". But I seem to recall that some folks were in favour of not including the domain info at all, for privacy / security reasons?  Or should we include the domain info in the discovery announcements of the proxy? Did we have a conclusion on that? 

Michael