IETF Logo Mail Archive

Re: [CDNi] URI Signing Signed Token Chaining refactor

Ray van Brandenburg <ray@tiledmedia.com> Wed, 19 July 2017 14:38 UTC

Return-Path: <ray@tiledmedia.com>
X-Original-To: cdni@ietfa.amsl.com
Delivered-To: cdni@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26ECF12F268 for <cdni@ietfa.amsl.com>; Wed, 19 Jul 2017 07:38:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.911
X-Spam-Level:
X-Spam-Status: No, score=-2.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=-1, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=tiledmedia.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zSHYUV0nmli9 for <cdni@ietfa.amsl.com>; Wed, 19 Jul 2017 07:38:44 -0700 (PDT)
Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40114.outbound.protection.outlook.com [40.107.4.114]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8887126CB6 for <cdni@ietf.org>; Wed, 19 Jul 2017 07:38:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tiledmedia.onmicrosoft.com; s=selector1-tiledmedia-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=JMywz9R6aPp4IAtwhEKwihqrO5H2zUF9/M8YjVGZiIo=; b=XTJM0Qooar9aOoHI615qDmwli3ci8sXGnD6uavq5jSxKmIGjdx5WLw02h/nUY2VaVWAevesLjAHj3QZ76df/IR5XtqHz26q5UfjMxzhovfC4xJ8AJyxWVbn8CQOCkFTiSK4jPr3nOfB2xO0KSefb35K+kl3P8bnDWTcS+Rg6HpU=
Received: from AM5PR0701MB3044.eurprd07.prod.outlook.com (10.168.157.13) by AM5PR0701MB2721.eurprd07.prod.outlook.com (10.173.93.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1282.4; Wed, 19 Jul 2017 14:38:40 +0000
Received: from AM5PR0701MB3044.eurprd07.prod.outlook.com ([fe80::d46:d591:f1c0:55d5]) by AM5PR0701MB3044.eurprd07.prod.outlook.com ([fe80::d46:d591:f1c0:55d5%18]) with mapi id 15.01.1282.007; Wed, 19 Jul 2017 14:38:40 +0000
From: Ray van Brandenburg <ray@tiledmedia.com>
To: "Kevin J. Ma" <kevin.j.ma.ietf@gmail.com>
CC: "Matthew A. Miller" <linuxwolf@outer-planes.net>, Phil Sorber <sorber@apache.org>, "cdni@ietf.org" <cdni@ietf.org>
Thread-Topic: [CDNi] URI Signing Signed Token Chaining refactor
Thread-Index: AQHTAJUCafvhrEh6vkqITYzFagrYeaJbKxaAgAAGYYCAAAOaAIAAAkmAgAAASoCAAAB3gIAAACcA
Date: Wed, 19 Jul 2017 14:38:40 +0000
Message-ID: <68FD4785-68D5-46A7-8BFB-2539611D097A@tiledmedia.com>
References: <CABF6JR3wEfUoCSJ29xQ3n56Ah1EqPnCvkZ4x6W5_cTW8V35Hwg@mail.gmail.com> <7CEB7DDD-7C33-4FD9-93BC-75E5E78AB3C2@gmail.com> <A2FBEA85-BF95-44A4-8E11-97D39C8DCF76@tiledmedia.com> <f56a1478-2457-6179-619f-b0f38700eaa6@outer-planes.net> <10AF9851-D7DA-42F8-A8E7-B70D4795E0E1@gmail.com> <68a60ab4-df68-6c59-cafc-3850012083cf@outer-planes.net> <D66E565F-32BF-4C36-9B20-98E1406F3D57@gmail.com>
In-Reply-To: <D66E565F-32BF-4C36-9B20-98E1406F3D57@gmail.com>
Accept-Language: en-US, nl-NL
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=tiledmedia.com;
x-originating-ip: [89.255.38.58]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; AM5PR0701MB2721; 7:NOyHt4zrh9l5DpqPLw3zVJtXvjqkZscAs/is9YE890rKID36wIk6bSupXGtOSWeEOTmeZOsBQjh/lCwlPc/wRDsNL/mCmGh+HgGVeicgFTJLYlVHbNUXdidEBQd9lrRKzKuRy4zHBwC8wVroeUE9nzW3+udH6L5ISMeJ+0ao2s4veNL+rmpyhU/LWZ0nrjvcTOW/rUO2EPzDYF+/eQO0K6dgnN5Uqnxed6FE+BCzcbLAhlZtH4NQfNCc3dWrh8rYBXykgTPRjsQG6+Tlb/cX513Nb2d12xq2rzHZWduCopHp16Gp3ZcesZ6hpOV241wJXeCe/DLFY44tTVCP+QypR694c9y8ZbkLuWyG2YwnOxkf7YNd3IiZIcdEDO4e6KNhJLKQ2piyX4gpgUeKUtIPCMiBmGa93jgaPhkrHaoy0PjZaZTmzJUbRy36O8F18Qud5tia0ZGnB+gMsV+AVUW1EfirbvisZ1vE6fdMd22E8/ncsTDXLO5EhkgcXBjaaFGHRNG2EFZEsU6LVuq/kLHp/Q0Wb01+oZbltSLvjitb1KKvoI8HZCY+/sa+2UNv+/wBHM44F/dyoq6r1A+JEQ4qc3SfJgzC9bAaV/MK9MiStlVBMPLm0RbxrlGyNcsxP+21AdR7xg6+aZsQvO/1Z2j0kK3yfIq0a94OQtXNHSziJ9Ui8/HylfjFtR1WjKzRJQtAMYDpj9CtnHc4qlYyHAC0QHCJxLicMEv0koh4lKi40HXsnmUxlxJsgv+W6c945l5VYl7MUOUkOVO0JzQTCdZbTZ6kXJPRDB11sWHnVs4ODOU=
x-ms-office365-filtering-correlation-id: c2c6d845-1b95-48ab-f8af-08d4ceb3d935
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254075)(300000503095)(300135400095)(2017052603031)(201703131423075)(201702281549075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095); SRVR:AM5PR0701MB2721;
x-ms-traffictypediagnostic: AM5PR0701MB2721:
x-exchange-antispam-report-test: UriScan:(278178393323532)(236129657087228)(192374486261705);
x-microsoft-antispam-prvs: <AM5PR0701MB27219152560141B3B58403FCCBA60@AM5PR0701MB2721.eurprd07.prod.outlook.com>
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(601004)(2401047)(2017060910075)(8121501046)(5005006)(3002001)(93006095)(93001095)(10201501046)(100000703101)(100105400095)(6041248)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(2016111802025)(20161123562025)(20161123558100)(20161123564025)(6043046)(6072148)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:AM5PR0701MB2721; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:AM5PR0701MB2721;
x-forefront-prvs: 0373D94D15
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39410400002)(39830400002)(39450400003)(39400400002)(377454003)(24454002)(5660300001)(14454004)(3660700001)(50986999)(54356999)(76176999)(93886004)(9886003)(4326008)(2900100001)(86362001)(305945005)(1720100001)(66066001)(229853002)(6486002)(53366004)(25786009)(53936002)(82746002)(7736002)(6506006)(2950100002)(189998001)(966005)(39060400002)(110136004)(6916009)(53376002)(38730400002)(5003630100001)(33656002)(6246003)(11609785009)(8676002)(8936002)(81166006)(3280700002)(83716003)(478600001)(5250100002)(54906002)(6436002)(6512007)(6306002)(2906002)(3846002)(102836003)(53546010)(99286003)(6116002)(36756003)(4068875011); DIR:OUT; SFP:1102; SCL:1; SRVR:AM5PR0701MB2721; H:AM5PR0701MB3044.eurprd07.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en;
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-ID: <111AF0223532FF46A83F255FBDC3AD24@eurprd07.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: tiledmedia.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Jul 2017 14:38:40.1750 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 0702b858-b758-4fb0-9e66-447a46ee0509
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0701MB2721
Archived-At: <https://mailarchive.ietf.org/arch/msg/cdni/BIPWnoiYmyq4FYC6GzysWZef0z8>
Subject: Re: [CDNi] URI Signing Signed Token Chaining refactor
X-BeenThere: cdni@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This list is to discuss issues associated with the Interconnection of Content Delivery Networks \(CDNs\)" <cdni.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/cdni>, <mailto:cdni-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cdni/>
List-Post: <mailto:cdni@ietf.org>
List-Help: <mailto:cdni-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/cdni>, <mailto:cdni-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 19 Jul 2017 14:38:46 -0000

Works for me.

Ray

> On 19 Jul 2017, at 16:38, Kevin J. Ma <kevin.j.ma.ietf@gmail.com> wrote:
> 
> I'm good with replacing "chaining" with "renewal".
> 
> Ray?
> 
> Sent from my iPhone
> 
>> On Jul 19, 2017, at 10:36 AM, Matthew A. Miller <linuxwolf@outer-planes.net> wrote:
>> 
>> Even simply 'Token Renewal' would be perfectly fine.  I'm most concerned
>> about the 'Chain' part.
>> 
>> 
>> - m&m
>> 
>> Matthew A. Miller
>> < http://goo.gl/LM55L >
>> 
>>> On 7/19/17 4:35 PM, Kevin J. Ma wrote:
>>> how do you feel about "short-lived token renewal"?
>>> 
>>> --  Kevin J. Ma
>>> 
>>> Sent from my iPhone
>>> 
>>>> On Jul 19, 2017, at 10:27 AM, Matthew A. Miller <linuxwolf@outer-planes.net> wrote:
>>>> 
>>>> Making it (a little bit) more generic makes sense.
>>>> 
>>>> I'm not sure about the name 'Signed Token Chain', but I don't have a
>>>> better one.  In cryptographic circles, "chain" has certain implications
>>>> that this document is not expressing.  The "next" item in the chain is
>>>> supposed to be cryptographically tied to the "previous" item in the
>>>> chain by using (a hash of, or the exact value of) the previous token
>>>> when generating the next token.
>>>> 
>>>> I don't know that that binding property is required here, so I'm not
>>>> suggesting a change in the protocol.  I do worry, however, that the
>>>> language may potentially confuse (or worse, mislead) people about the
>>>> security properties this document is providing.
>>>> 
>>>> 
>>>> - m&m
>>>> 
>>>> Matthew A. Miller
>>>> < http://goo.gl/LM55L >
>>>> 
>>>>> On 7/19/17 4:14 PM, Ray van Brandenburg wrote:
>>>>> Yes, good point!
>>>>> 
>>>>> Although I can’t think of another use case from the top of my head, I don’t see a good reason to limit it to HAS either.
>>>>> 
>>>>> Ray
>>>>> 
>>>>> 
>>>>>> On 19 Jul 2017, at 15:51, Kevin J. Ma <kevin.j.ma.ietf@gmail.com> wrote:
>>>>>> 
>>>>>> (as an individual) I agree with making the section more generic and citing HAS as a use case for token chaining.
>>>>>> 
>>>>>> Sent from my iPhone
>>>>>> 
>>>>>>> On Jul 19, 2017, at 9:43 AM, Phil Sorber <sorber@apache.org> wrote:
>>>>>>> 
>>>>>>> Since we have added the HAS content I have been thinking about how specific we have made it. Perhaps just specifying a method for token chaining, and then citing HAS as a use case makes more sense. I wanted to get some opinions on it before I make those changes. It shouldn't be that big of a change, just taking the HAS specific stuff and putting it in a lower "Use Case" sub-section at the bottom and leaving everything else as a "Signed Token Chaining" section.
>>>>>>> 
>>>>>>> Thoughts?
>>>>>>> 
>>>>>>> Thanks.
>>>>>>> _______________________________________________
>>>>>>> CDNi mailing list
>>>>>>> CDNi@ietf.org
>>>>>>> https://www.ietf.org/mailman/listinfo/cdni
>>>>> 
>>>> 
>>

v2.23.0 | Report a Bug | By Email