Subject: [Acme] Inner nonces for key-change (was Re: Unparallelizing roll-over)

From: Richard Barnes <[email-masked]>
Date: Fri, 19 Aug 2016 15:42:56 -0400

[Forking this into two threads]

[Fork 2 of 2]

On Fri, Aug 19, 2016 at 2:30 PM, Jacob Hoffman-Andrews <[email-masked]> wrote:

> On 08/19/2016 09:31 AM, Richard Barnes wrote:
> > On further thought, I think I would like to propose that we go back to
> > not caring about the nonce.
>
> There was some earlier discussion about why the nonce on the inner
> payload was valuable. Could you quote that here and specifically rebut?
> I think I agree with dropping it this but I want to make sure we keep
> the context of the original discussion.
>

The original arguments were from EKR and AGWA:

https://github.com/ietf-wg-acme/acme/pull/164#discussion_r72745016

EKR's comment was w.r.t. "url", which I extended to "nonce" by a general
design argument.  I've come around to being a bit more flexible with the
inner JWS.

AGWA raises the unexpected transfer risks that I mentioned up-thread.  I
think we're addressing those adequately with the "account" stuff we're
talking about; in any case, those risks are related to identifying
accounts, not to nonces.

--Richard