Subject: [CDNi] draft-ietf-cdni-uri-signing-07 questions and comments

From: Gancho Tenev <[email-masked]>
Date: Sun, 10 Apr 2016 23:20:29 -0700

Dear Ray and Kent, 

   Thank you very much for taking the time to discuss my questions and comments right after IETF-95 CDNI meeting this past week.

As I mentioned my implementation is based on draft-ietf-cdni-uri-signing-07. I thought it would be a good idea to reiterate our discussion.

(1) CDNI URI Signing package uses “&” character as IE delimiter. OUC and UPC could contain the original URI (OUC) or a list of URI patterns (UPC) which in turn could contain “&” character and possibly even query parameters named the same way like the IEs. 

One way to address this would be to percent-encode UPC. OUC is not included in the final package (removed after signing) hence percent-encoding it is probably not necessary.

(2) The draft mentions only the following values for HF, DSA, CEA IE - “SHA-256”, "EC-DSA”, “AES-128”. Different encryption implementations use different algorithm names (i.e. “SHA-256” vs. “SHA256”) that could lead to signature validation failures due to naming mismatch between different CDNI URI Signing implementations.

One way to address this would be to define the algorithm names or point to already existing definitions.

(3) The signing algorithm in draft-ietf-cdni-uri-signing-07 uses full URIs (excluding scheme component) when signing and verifying and full URIs when enforcing distribution policies. 

We have use-cases where we would sign ignoring the URI scheme and authority components. In our implementation verifying, enforcing distribution policies based on the whole URI would lead to an unnecessary re-assembling of the whole URI from its components already disassembled at the beginning stages of the HTTP state machine.

Functionally draft-ietf-cdni-uri-signing-07 already has those use-cases covered by using UPC but I was wondering if we could have some means to help the implementation optimize its performance (avoiding the extra re-assembly).

We had a short discussion and (I think) Ray came up with an interesting idea of using well-defined URI patterns to facilitate more optimal implementation.

Looking forward to the new version! Thanks again!

Best regards,
--Gancho

---

From: "Brandenburg, R. (Ray) van" <[email-masked]>
Date: Tue, 12 Apr 2016 11:33:15 +0000

Hi Gancho,

Thanks again for helping us improve the draft based on your implementation experience!

I hope to be able to publish a new version of the draft within the next two weeks where I'll address your comments. 

Best regards,

Ray

On 11/04/16 08:20, "CDNi on behalf of Gancho Tenev" <[email-masked] on behalf of [email-masked]> wrote:

>_______________________________________________
>CDNi mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/cdni
This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. TNO accepts no liability for the content of this e-mail, for the manner in which you use it and for damage of any kind resulting from the risks inherent to the electronic transmission of messages.