Re: [CDNi] Early AD review of draft-ietf-cdni-metadata-17

[Ben Niven-Jenkins <[e-mail]>]

Alexey, Kevin,

I’m coming to the party a bit late (unfortunately I have very little time for IETF work these days). This caught my eye and I wanted to comment on it.

> On 2 Jun 2016, at 15:15, Kevin Ma J <[e-mail]> wrote:
> 
> wrt:
>>> In 7.4: I think I am sad that you haven't defined any initial
>>> authentication mechanism. Has this been discussed in the WG?
> 
> The thought behind this was that URI Signing would be the primary delivery auth mechanism, and could also be used for acquisition auth; but thank you for reminding me that I missed the Auth Type registration in https://tools.ietf.org/html/draft-ietf-cdni-uri-signing-07#section-8.  :)

URL signing provides authorisation, not authentication.

At the time my opinion/thinking (and it hasn’t changed since) was:

- The vast majority of HTTP content is delivered without authentication.
- Defining authentication is hard - by which I mean the auth itself is not hard, specifying a secure way to distribute secrets etc is hard, as illustrated by the need for a LURK WG for doing something similar for related but not identical use cases to CDNI.
- I was worried trying to define a secure way to distribute auth secrets etc would delay the work unnecessarily both in terms of time spent in the WG and time spent getting whatever mechanism we defined past the IESG.

Authenticating the channel over which the CDNI metadata is distributed (as opposed to authenticating the User Agent/user requesting the content from the dCDN) is already specified/mandated in the document IIRC.

Ben