IPTC Anchor List

[domguinard]

Section 8.2.4.1. "Interim trust model additions" of the CAWG Identity spec is offering 2 options for the current SMIME model:

1. Mozilla root store for SMIME

2. The IPTC trust list, however, the anchor list linked in this section is empty:
   https://trust.iptc.org/anchor-list.pem
   is this anchor list meant to be empty?

[pmougin]

For now, only the end-entity certificate trust list (https://trust.iptc.org/end-entity-list.pem) is populated. IPTC is working on the certificate policy and the other elements needed to scale to an anchor-based system. Once this is in place, anchor-list is indeed expected to contain the relevant trust-anchor certificates.

[domguinard]

For now, only the end-entity certificate trust list (https://trust.iptc.org/end-entity-list.pem) is populated. IPTC is working on the certificate policy and the other elements needed to scale to an anchor-based system. Once this is in place, anchor-list is indeed expected to contain the relevant trust-anchor certificates.

Thanks a lot @pmougin. Should we perhaps remove the link to the anchor-list then while the system is still being worked on? The empty list is confusing for implementers isn't it?
I'm happy to submit the PR to remove it if you think it makes sense.

[pmougin]

Thanks @domguinard. I understand the confusion, but the link must not be removed.
For Identity Assertion 1.2, this is part of a ratified specification.
For the 1.3 draft, the link must also remain: compliant validators should continue to be designed to support this anchor-list mechanism.
The trust-list lifecycle should stay decoupled from the specification lifecycle: the list can be populated later without requiring a specification change.