Subject: [CDNi] URI Signing Signed Token Chaining refactor

From: Phil Sorber <[email-masked]>
Date: Wed, 19 Jul 2017 13:43:09 +0000

Since we have added the HAS content I have been thinking about how specific
we have made it. Perhaps just specifying a method for token chaining, and
then citing HAS as a use case makes more sense. I wanted to get some
opinions on it before I make those changes. It shouldn't be that big of a
change, just taking the HAS specific stuff and putting it in a lower "Use
Case" sub-section at the bottom and leaving everything else as a "Signed
Token Chaining" section.

Thoughts?

Thanks.

---

From: "Kevin J. Ma" <[email-masked]>
Date: Wed, 19 Jul 2017 09:51:31 -0400

(as an individual) I agree with making the section more generic and citing HAS as a use case for token chaining.

Sent from my iPhone

> On Jul 19, 2017, at 9:43 AM, Phil Sorber <[email-masked]> wrote:
> 
> Since we have added the HAS content I have been thinking about how specific we have made it. Perhaps just specifying a method for token chaining, and then citing HAS as a use case makes more sense. I wanted to get some opinions on it before I make those changes. It shouldn't be that big of a change, just taking the HAS specific stuff and putting it in a lower "Use Case" sub-section at the bottom and leaving everything else as a "Signed Token Chaining" section.
> 
> Thoughts?
> 
> Thanks.
> _______________________________________________
> CDNi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cdni

---

From: Ray van Brandenburg <[email-masked]>
Date: Wed, 19 Jul 2017 14:14:21 +0000

Yes, good point!

Although I can’t think of another use case from the top of my head, I don’t see a good reason to limit it to HAS either.

Ray

> On 19 Jul 2017, at 15:51, Kevin J. Ma <[email-masked]> wrote:
>

---

From: "Matthew A. Miller" <[email-masked]>
Date: Wed, 19 Jul 2017 16:27:14 +0200

Making it (a little bit) more generic makes sense.

I'm not sure about the name 'Signed Token Chain', but I don't have a
better one.  In cryptographic circles, "chain" has certain implications
that this document is not expressing.  The "next" item in the chain is
supposed to be cryptographically tied to the "previous" item in the
chain by using (a hash of, or the exact value of) the previous token
when generating the next token.

I don't know that that binding property is required here, so I'm not
suggesting a change in the protocol.  I do worry, however, that the
language may potentially confuse (or worse, mislead) people about the
security properties this document is providing.

- m&m

Matthew A. Miller
< http://goo.gl/LM55L >

---

From: "Kevin J. Ma" <[email-masked]>
Date: Wed, 19 Jul 2017 10:35:25 -0400

how do you feel about "short-lived token renewal"?

--  Kevin J. Ma

Sent from my iPhone

> On Jul 19, 2017, at 10:27 AM, Matthew A. Miller <[email-masked]> wrote:
>

---

From: "Matthew A. Miller" <[email-masked]>
Date: Wed, 19 Jul 2017 16:36:27 +0200

Even simply 'Token Renewal' would be perfectly fine.  I'm most concerned
about the 'Chain' part.

- m&m

Matthew A. Miller
< http://goo.gl/LM55L >

---

From: "Kevin J. Ma" <[email-masked]>
Date: Wed, 19 Jul 2017 10:38:07 -0400

I'm good with replacing "chaining" with "renewal".

Ray?

Sent from my iPhone

> On Jul 19, 2017, at 10:36 AM, Matthew A. Miller <[email-masked]> wrote:
>

---

From: Ray van Brandenburg <[email-masked]>
Date: Wed, 19 Jul 2017 14:38:40 +0000

Works for me.

Ray

> On 19 Jul 2017, at 16:38, Kevin J. Ma <[email-masked]> wrote:
>

---

From: Phil Sorber <[email-masked]>
Date: Wed, 19 Jul 2017 14:56:23 +0000

Ok, I'll put together a PR.

Thanks.

On Wed, Jul 19, 2017 at 4:39 PM Ray van Brandenburg <[email-masked]>
wrote:

> >>>>> Although I can’t think of another use case from the top of my head,
> I don’t see a good reason to limit it to HAS either.
> >>>>>
> >>>>> Ray
> >>>>>
> >>>>>
> >>>>>> (as an individual) I agree with making the section more generic and
> citing HAS as a use case for token chaining.
> >>>>>>
> >>>>>> Sent from my iPhone
> >>>>>>
> >>>>>>> Since we have added the HAS content I have been thinking about how
> specific we have made it. Perhaps just specifying a method for token
> chaining, and then citing HAS as a use case makes more sense. I wanted to
> get some opinions on it before I make those changes. It shouldn't be that
> big of a change, just taking the HAS specific stuff and putting it in a
> lower "Use Case" sub-section at the bottom and leaving everything else as a
> "Signed Token Chaining" section.
> >>>>>>>
> >>>>>>> Thoughts?
> >>>>>>>
> >>>>>>> Thanks.