[Cbor] Re: I-D Action: draft-mcnally-deterministic-cbor-10.html

[Anders Rundgren <[e-mail]>]

On 2024-07-30 08:54, Carsten Bormann wrote:
> On 29. Jul 2024, at 15:49, Joe Hildebrand <[e-mail]> wrote:
>>
>> Using URLs as identifiers is fine until people start dereferencing them at runtime, which they ALWAYS seem to do for some reason.
> 
> More about that at:
> 
> [The "dereferenceable identifier" pattern](https://www.ietf.org/archive/id/draft-bormann-t2trg-deref-id-03.html)

Automatic downloading of schemas and similar may not only create security issues, but is also likely to cause interoperability failures if a schema suddenly features a new element.

However, since many systems have a tendency of changing fairly frequently, there is still a need for a more dynamic solution.  In addition, not all parties using a particular schema may always be at the same revision level.

A possible solution to this conundrum is to use discovery services which inform callers what to expect before the actual [potentially adapted] call is performed.

A real-world (but PoC) example: https://test.webpki.org/saturn-payeebank/authority

This is one of the primary targets for the Enterprise Application profile.  Preferably using the .well-known mechanism.

Discovery services can provide many different pieces of information, including cryptographic algorithm support.

CBOR keys based on URLs seem like a reasonable way to signal new API features in contexts like Open Banking.

Anders





> 
> Grüße, Carsten
>