Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are the main reasons for having a federated identity system such as OpenID over having identities based purely on a public key?

OpenID uses an Identity Provider to confirm that a user owns a particular URL. Why not use a public key identifier. If the user can decrypt information encrypted with the public key, then they must own that public key. This would remove the need for identity providers and give users complete control over their own Identity.

share|improve this question

The simple answer is that of course you could do that but then you would have to manage the infrastructure to cope with key management, and some organisations do exactly that.

It is a challenge, though, at large scale, so why not offload some of that onto a trusted provider? That way they can focus on the identity management and you can focus on your business.

Simple outsourcing model in many respects.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.