Re: VCs - zCaps / OCap a Discussion

David Chadwick <D.W.Chadwick@kent.ac.uk> wrote:

>
> >
> > You may still want to delegate a bearer capability for sub-scoping and
> > responsibility tracking.
>
> Yes you can do that, but only for a non-bearer credential that you have.
> A bearer credential by its very definition does not belong to anyone
> specifically. Some external (to the credential) mechanism would be
> needed to track its provenance, rather like banks track your money in
> its account. They cannot track the notes you hold unless they record
> their serial numbers.
>

You're right.  My thinking is colored by my work using SAML certificates,
which are assumed to be public documents.  That ruled out true bearer
credentials.  We noted you could get behavior similar to a bearer
credential by sharing the certificate and the private key it was issued
to.  Any holder could then do a sub-scope delegation.  That approach
doesn't work with true bearer credentials.

--------------
Alan Karp