[CDNi] New Liaison Statement, "Response to request for information on URI Signing 2015-11-02"

[Liaison Statement Management Tool <[e-mail]>]

Title: Response to request for information on URI Signing 2015-11-02
Submission Date: 2015-12-30
URL of the IETF Web page: https://datatracker.ietf.org/liaison/1450/

From: "Kevin J. Ma" <[e-mail]>
To: Watanabe Shinji <[e-mail]>
Cc: Barry Leiba <[e-mail]>,Ben Campbell <[e-mail]>,Content Delivery Networks Interconnection Discussion List <[e-mail]>,Alissa Cooper <[e-mail]>,Francois Le Faucheur <[e-mail]>,Kevin Ma <[e-mail]>,Stephan Wenger <[e-mail]>,
Response Contacts: Kevin Ma <[e-mail]>,Francois Le Faucheur <[e-mail]>
Technical Contacts: Ray van Brandenburg <[e-mail]>
Purpose: In response

Referenced liaison: Liaison Statement to IETF on URI signing (https://datatracker.ietf.org/liaison/1434/)

Body: The IETF CDNI working group would like to acknowledge our receipt of the MPEG experts liaison letter and careful consideration during the 94th IETF meeting.

Having reviewed the Online Multimedia Authorization Protocol Version 1.0 (OMAPv1) specification [2012_09_28_OATC-OMAP_1-0], we understand the proposed scope of usage for CDNI URI Signing to be the only as the Access Token, as returned by the authorization server in step (E) of sections 2.3 and 2.4 of the OMAPv1 specification, to be use solely for authorizing requests to the resource server (i.e., the CDN), as described in steps (F) and (G) of sections 2.3 and 2.4 of the OMAPv1 specification.  We agree that this is an exemplary use case for CDNI URI Signing with the Path Pattern Information Element.
 
At the 93rd IETF, the CDNI working group decided to remove text related to signing of segmented content URIs from the CDNI URI Signing draft [draft-ietf-cdni-uri-signing] in response to an IPR disclosure made after the 92nd IETF [minutes-93-cdni]. The removed sections are currently documented in a separate draft [draft-brandenburg-cdni-uri-signing-for-has], as an extension to the CDNI URI signing draft [draft-ietf-cdni-uri-signing]. It should be noted that at this point, that document is regarded as an individual submission and the CDNI working group has not made a decision regarding its future status. At the 94th IETF, it was agreed that the Path Pattern Information element was not covered by the IPR disclosure and would be a useful feature for a number of URI Signing use cases, including segmented content [minutes-94-cdni]. Path Pattern support will be reinstated in a future revision of the CDNI URI signing draft [draft-ietf-cdni-uri-signing].
 
With respect to long-lived tokens, as mentioned in the Security Considerations section (9) of the CDNI URI Signing draft, increasing the token validity period increases the potential for replay attacks, including DoS attacks; however, nothing in the protocol prevents the use of long-lived tokens. 

With respect to CDNs refreshing tokens, the CDNI working group discussed mechanisms for signaling token refresh between CDNs and felt that the required additional complexity of such a mechanism outweighed the cost of regenerating the tokens. Note: Signaling between CDNs and clients is out-of-scope for CDNI. As mentioned above, chained token support was removed from the CDNI URI Signing draft [draft-ietf-cdni-uri-signing] and there is no plan to reinstate it in the CDNI URI signing draft [draft-ietf-cdni-uri-signing] due to IPR issues. As such, the topic of token regeneration is limited to the extension draft [draft-brandenburg-cdni-uri-signing-for-has].

With respect to name collisions, the current version of the CDNI URI Signing draft [draft-ietf-cdni-uri-signing] only supports query-string-based conveyance of the token.  The metadata element "package-attribute" was introduced to allow content service providers (CSPs) to select any query string parameter name they wanted, assuming that CSPs would be in the best position to select a low-collision-probability name; URISigningPackage is only the default name.
 
With respect to consecutive tokens, the CDNI URI Signing mechanism was designed to be stateless, so that consecutive tokens can be retrieved from different delivery nodes. As such, there is no relationship between consecutive tokens and token invalidation is solely based on the Expiry Time information element.

The CDNI working group appreciates the MPEG experts' thoughtful input and looks forward to continued collaboration with MPEG experts on URI Signing.
 
Our next meeting: IETF 95, April 3-8 2016, Buenos Aires, Argentina

[2012_09_28_OATC-OMAP_1-0] http://www.oatc.us/Portals/_default/Knowledgebase/1/2012_09_28_OATC-OMAP_1-0.pdf
[draft-ietf-cdni-uri-signing] https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/
[draft-brandenburg-cdni-uri-signing-for-has] https://datatracker.ietf.org/doc/draft-brandenburg-cdni-uri-signing-for-has/
[minutes-93-cdni] https://www.ietf.org/proceedings/93/minutes/minutes-93-cdni
[minutes-94-cdni] https://www.ietf.org/proceedings/94/minutes/minutes-94-cdni


Attachments:

No document has been attached