Subject: [Geopriv] Q3 about draft-ietf-geopriv-lbyr-requirements-01

From: "James M. Polk" <[email-masked]>
Date: Fri, 15 Feb 2008 18:32:16 -0600

I may have missed the text, but I don't see it in a requirement -- 
but at the last meeting, I was told by James W and Hannes that each 
LbyR URI MUST be unique.  I don't read that anywhere in this ID.

I read that "...it MUST be hard to guess..."

why can't all 200 participants in the room draw from a smaller pool 
of numbers that a cryptographically random value?  It would still be 
"hard to guess" who has which identifier...

James 

_______________________________________________
Geopriv mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/geopriv

---

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Sun, 17 Feb 2008 12:47:37 +0100

Uniqueness is very important. The draft should really have such a requirement. Saying that a part of the identifier is random is not enough.  

We need to add a requirement. 

Ciao
Hannes

> -----Ursprüngliche Nachricht-----
> Von: [email-masked] 
> [mailto:[email-masked]] Im Auftrag von ext James M. Polk
> Gesendet: Samstag, 16. Februar 2008 02:32
> An: [email-masked]
> Betreff: [Geopriv] Q3 about draft-ietf-geopriv-lbyr-requirements-01
>

---

From: Richard Barnes <[email-masked]>
Date: Sun, 17 Feb 2008 21:27:50 -0500

Could you two clarify what you mean by "unique"?  That is, within what 
scope should the URI be unique?  Do you mean to prevent the LS from 
issuing multiple URIs that refer to the same location?  Or are you 
trying to rule out a case where an LS just hands out one URI (or a few 
URIs), then hands out different LOs depending on who asks (i.e., the LS 
uses one URI to refer to multiple LOs)?

--Richard

---

From: "James M. Polk" <[email-masked]>
Date: Sun, 17 Feb 2008 21:04:50 -0600

At 08:27 PM 2/17/2008, Richard Barnes wrote:
>Could you two clarify what you mean by "unique"?

well, this is part of what I was getting at. For 
example, within RFC 3261, the Call-ID value "MUST 
be unique through space and time" -- meaning the 
alphanumeric value is never repeatable by any UA 
ever, not just within the same UA.

This is reeeeally unique.

I think this is more than we need here.

>That is, within what scope should the URI be unique?

I think a URI has to be unique within a LIS for 
all clients that have asked for one. I'm not sure 
we need to be any more unique than that.

>Do you mean to prevent the LS from issuing 
>multiple URIs that refer to the same location?

I actually don't see a problem in this... but I 
could be wrong (and want to know why I'm wrong BTW)

>Or are you trying to rule out a case where an LS 
>just hands out one URI (or a few URIs), then 
>hands out different LOs depending on who asks 
>(i.e., the LS uses one URI to refer to multiple LOs)?

No, from my pov, unique means that a LIS has one 
unique URI for each client that has asked for one.

I do not believe this URI has to be unique from 
what's given out tomorrow, as long as no two 
clients have the same URI.  This is one of the 
uses of the valid-for parameter (that both the 
DHCP Option ID and HELD ID have).  My client 
shouldn't necessarily always be given the same 
URI, since there is no real guarantee it won't be 
compromised, someone will always have knowledge 
of my URI once they learn it once.

Having my URI change periodically has a benefit, 
as long as it doesn't change sooner than the 
active timer of the 'valid-for' parameter is set 
(unless there's been a new request and a 
particular client's URI has been overwritten.

>>Uniqueness is very important. The draft should 
>>really have such a requirement. Saying that a 
>>part of the identifier is random is not enough.
>>>I may have missed the text, but I don't see it 
>>>in a requirement -- but at the last meeting, I 
>>>was told by James W and Hannes that each LbyR 
>>>URI MUST be unique.  I don't read that anywhere in this ID.
>>>
>>>why can't all 200 participants in the room 
>>>draw from a smaller pool of numbers that a 
>>>cryptographically random value?  It would 
>>>still be "hard to guess" who has which identifier...
>>>
>>>James

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 19 Feb 2008 12:15:36 +0200

You cannot hand out URIs that point to the location of different 
targets  (ignoring the case where they do not matter for  the LIS point 
of view, such as  2 hosts being behind a NAT).