Subject: [Lurk] Terminology

From: Daniel Migault <[email-masked]>
Date: Mon, 14 Mar 2016 12:09:08 +0000

Hi,

So far, the use case draft [1] introduces the following terminology:

-          TLS Client

-          TLS Server

-          Edge Server

-          Content Provider

-          Split Use case / Split Authentication

Dimitry suggested to replace Content Provider by Content Owner. I think that is much better.

I would like to leave TLS Client / Server when we designate the two end points of a TLS session otherwise I think it is better to talk about the Web Client / Edge Server / Content Owner. Any opinion ?

I am sure we can find something better than the "Split". Alternative propositions have been SKI for Session Key Interface (SKI), Keyless. Has anyone other propositions ?

Comments/suggestions are welcome.

BR,
Daniel

[Ericsson]<http://www.ericsson.com/>

DANIEL MIGAULT
Researcher
Research

Ericsson
8500 Boulevard Decarie
H4P 2N2 Montreal, Canada
Phone +1 514 345 7900 46628
Mobile +1 514 452 2160
[email-masked]
www.ericsson.com

[http://www.ericsson.com/current_campaign]<http://www.ericsson.com/current_campaign>

Legal entity: Ericsson Canada Inc., registered office in Montreal. This Communication is Confidential. We only send and receive email on the basis of the terms set out at www.ericsson.com/email_disclaimer<http://www.ericsson.com/email_disclaimer>

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 14 Mar 2016 13:42:51 +0000

I think Content Provider makes more sense, since the provider isn’t necessarily the owner.  Particularly in the CDN case.

--
Senior Architect, Akamai Technologies
IM: [email-masked] Twitter: RichSalz

From: Daniel Migault [mailto:[email-masked]]
Sent: Monday, March 14, 2016 8:09 AM
To: LURK BoF
Cc: Dmitry Belyavsky
Subject: [Lurk] Terminology

Hi,

-          TLS Client

-          TLS Server

-          Edge Server

-          Content Provider

I am sure we can find something better than the “Split”. Alternative propositions have been SKI for Session Key Interface (SKI), Keyless. Has anyone other propositions ?

BR,
Daniel

[Ericsson]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ericsson.com_&d=CwMFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=pMndqs1EMU-Qs83npQSMLZbomKS0laDlqjcjTss_P3A&s=MVJNqlc3PQT2QNRY6lsGdNN1eU0F6N0_2n59vQuSEqo&e=>
DANIEL MIGAULT
Researcher
Research

Ericsson
8500 Boulevard Decarie
H4P 2N2 Montreal, Canada
Phone +1 514 345 7900 46628
Mobile +1 514 452 2160
[email-masked]<mailto:[email-masked]>
www.ericsson.com<http://www.ericsson.com>

[http://www.ericsson.com/current_campaign]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ericsson.com_current-5Fcampaign&d=CwMFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=pMndqs1EMU-Qs83npQSMLZbomKS0laDlqjcjTss_P3A&s=zRFlw2yGHIuBUowbDULvzV6_OiEUri_-BBiSuxbRy50&e=>

Legal entity: Ericsson Canada Inc., registered office in Montreal. This Communication is Confidential. We only send and receive email on the basis of the terms set out at www.ericsson.com/email_disclaimer<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ericsson.com_email-5Fdisclaimer&d=CwMFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=pMndqs1EMU-Qs83npQSMLZbomKS0laDlqjcjTss_P3A&s=8liUyfFU6pEfzqt1pNcbfljhdZnrfZpD_gKK2GipOlU&e=>

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 14 Mar 2016 06:52:04 -0700

Isn't the usual term "Origin Server"

On Mon, Mar 14, 2016 at 6:42 AM, Salz, Rich <[email-masked]> wrote:

> I think Content Provider makes more sense, since the provider isn’t
> necessarily the owner.  Particularly in the CDN case.
>
>
>
> --
>
> *From:* Daniel Migault [mailto:[email-masked]]
> *Sent:* Monday, March 14, 2016 8:09 AM
> *To:* LURK BoF
> *Cc:* Dmitry Belyavsky
> *Subject:* [Lurk] Terminology
>
>
>
> Hi,
>
>
>
> I would like to leave TLS Client / Server when we designate the two end
> points of a TLS session otherwise I think it is better to talk about the
> Web Client / Edge Server / Content Owner. Any opinion ?
>
>
>
> I am sure we can find something better than the “Split”. Alternative
> propositions have been SKI for Session Key Interface (SKI), Keyless. Has
> anyone other propositions ?
>
>
>
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ericsson.com_&d=CwMFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=pMndqs1EMU-Qs83npQSMLZbomKS0laDlqjcjTss_P3A&s=MVJNqlc3PQT2QNRY6lsGdNN1eU0F6N0_2n59vQuSEqo&e=>
>
> *DANIEL MIGAULT *
> Researcher
> Research
>
>
> *Ericsson*
> 8500 Boulevard Decarie
> H4P 2N2 Montreal, Canada
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ericsson.com_current-5Fcampaign&d=CwMFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=pMndqs1EMU-Qs83npQSMLZbomKS0laDlqjcjTss_P3A&s=zRFlw2yGHIuBUowbDULvzV6_OiEUri_-BBiSuxbRy50&e=>
>
>
>
> Legal entity: Ericsson Canada Inc., registered office in Montreal. This
> Communication is Confidential. We only send and receive email on the basis
> of the terms set out at www.ericsson.com/email_disclaimer
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ericsson.com_email-5Fdisclaimer&d=CwMFAg&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=pMndqs1EMU-Qs83npQSMLZbomKS0laDlqjcjTss_P3A&s=8liUyfFU6pEfzqt1pNcbfljhdZnrfZpD_gKK2GipOlU&e=>
>
> _______________________________________________
> Lurk mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/lurk
>
>

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 14 Mar 2016 13:55:30 +0000

Yes it’s a common term, but I think it’s meaning varies.  From our perspective, the origin is the Akamai customer’s website with the content.  But from a browser perspective, if the DNS and certificate both send them to an akamai server, then we’d be the origin.

Which is why I think owner and provider is a more clear set of terms.

From: Eric Rescorla [mailto:[email-masked]]
Sent: Monday, March 14, 2016 9:52 AM
To: Salz, Rich
Cc: Daniel Migault; LURK BoF; Dmitry Belyavsky
Subject: Re: [Lurk] Terminology

On Mon, Mar 14, 2016 at 6:42 AM, Salz, Rich <[email-masked]<mailto:[email-masked]>> wrote:
I think Content Provider makes more sense, since the provider isn’t necessarily the owner.  Particularly in the CDN case.

--
Senior Architect, Akamai Technologies
IM: [email-masked]<mailto:[email-masked]> Twitter: RichSalz

From: Daniel Migault [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Monday, March 14, 2016 8:09 AM
To: LURK BoF
Cc: Dmitry Belyavsky
Subject: [Lurk] Terminology

Hi,

-          TLS Client

-          TLS Server

-          Edge Server

-          Content Provider

BR,
Daniel

Ericsson
8500 Boulevard Decarie
H4P 2N2 Montreal, Canada
Phone +1 514 345 7900 46628
Mobile +1 514 452 2160<tel:%2B1%20514%20452%202160>
[email-masked]<mailto:[email-masked]>
www.ericsson.com<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ericsson.com&d=CwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=O7kjE1bfEh1mO0McViynSapPbCrgV0nhhKKohzYcP5A&s=s228blgMfujLa03YmLZ20j5P2ZtaB1dXPDYVf98qq6M&e=>

_______________________________________________
Lurk mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/lurk<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_lurk&d=CwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=O7kjE1bfEh1mO0McViynSapPbCrgV0nhhKKohzYcP5A&s=62Qi568SGYMm4EoI0MBA_cxDAj5k6YzFK8EPVCmnqbc&e=>

---

From: Martin Thomson <[email-masked]>
Date: Tue, 15 Mar 2016 11:39:43 +1100

> necessarily the owner.  Particularly in the CDN case.

This isn't about content provision, though, is it?

It's about the holder of the private key and the entity that terminates the
connection.

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 15 Mar 2016 01:18:57 +0000

>This isn't about content provision, though, is it?

Isn't that exactly what this is about?

>It's about the holder of the private key and the entity that terminates the connection.

So perhaps http terminology isn't accurate for this case.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 16 Mar 2016 12:30:28 -0400

> So perhaps http terminology isn't accurate for this case.

I am pretty sure that this really isn't about content provision except
as a use case scenario.

There are essentially three solutions to that scenario. One is short
lived credentials which is already covered by ACME. The second is a
key-on-a-stick type protocol, the third is a
not-quite-a-key-on-a-stick. i.e both servers have a part of the
private key.

Looking at the protocol implementation, the only difference between 2
and 3 come down to algorithm identifiers, if at all. Doing a Diffie
Hellman key agreement is actually the same whether you have the
private key or just a bit of it. I know how to do split key for DH key
agreement, not so sure about signature, the threshold schemes I liked
were based on RSA.

But regardless, if we have a protocol for use of a private key kept
remotely, that is going to be a ubiquitously useful component in a lot
of situations. It would be the obvious way to plug in a crypto
accelerator board for example. We could apply the approach to code
signing.