Re: [CDNi] Response to Liaison Statement on URI Signing

I cleaned up the draft language
- removed "main" or changed "main" -> "CDNI" in all places
- used "extension" to refer to Ray's draft
- changed "document" -> "draft" in all places
- added references to [draft-ietf-cdni-uri-signing] after all mentions of the draft

From: Kevin J. Ma
From Group: CDNI
To: Watanabe Shinji <watanabe@itscj.ipsj.or.jp>
To Group: ISO-IEC-JTC1-SC29
Title: Response to request for information on URI Signing 2015-11-02
Response Contact: Kevin J. Ma <kevin.j.ma@ericsson.com>
Technical Contact: Ray van Brandenburg <ray.vanbrandenburg@tno.nl>
Purpose: In Response
Body:

The IETF CDNI working group would like to acknowledge our receipt of the MPEG experts liaison letter and careful consideration during the 94th IETF meeting.

Having reviewed the Online Multimedia Authorization Protocol Version 1.0 (OMAPv1) specification [2012_09_28_OATC-OMAP_1-0], we understand the proposed scope of usage for CDNI URI Signing to be the only as the Access Token, as returned by the authorization server in step (E) of sections 2.3 and 2.4 of the OMAPv1 specification, to be use solely for authorizing requests to the resource server (i.e., the CDN), as described in steps (F) and (G) of sections 2.3 and 2.4 of the OMAPv1 specification.  We agree that this is an exemplary use case for CDNI URI Signing with the Path Pattern Information Element.

At the 93rd IETF, the CDNI working group decided to remove text related to signing of segmented content URIs from the CDNI URI Signing draft [draft-ietf-cdni-uri-signing] in response to an IPR disclosure made after the 92nd IETF [minutes-93-cdni]. The removed sections are currently documented in a separate draft [draft-brandenburg-cdni-uri-signing-for-has], as an extension to the CDNI URI signing draft [draft-ietf-cdni-uri-signing]. It should be noted that at this point, that document is regarded as an independent submission and IETF has not made a decision regarding its future status. At the 94th IETF, it was agreed that the Path Pattern Information element was not covered by the IPR disclosure and would be a useful feature for a number of URI Signing use cases, including segmented content [minutes-94-cdni]. Path Pattern support will be reinstated in a future revision of the CDNI URI signing draft [draft-ietf-cdni-uri-signing].

With respect to long-lived tokens, as mentioned in the Security Considerations section (9) of the CDNI URI Signing draft, increasing the token validity period increases the potential for replay attacks, including DoS attacks; however, nothing in the protocol prevents the use of long-lived tokens. 

With respect to CDNs refreshing tokens, the CDNI working group discussed mechanisms for signaling token refresh between CDNs and felt that the required additional complexity of such a mechanism outweighed the cost of regenerating the tokens. Note: Signaling between CDNs and clients is out-of-scope for CDNI. As mentioned above, chained token support was removed from the CDNI URI Signing draft [draft-ietf-cdni-uri-signing] and there is no plan to reinstate it in the CDNI URI signing draft [draft-ietf-cdni-uri-signing] due to IPR issues. As such, the topic of token regeneration is limited to the extension draft [draft-brandenburg-cdni-uri-signing-for-has].

With respect to name collisions, the current version of the CDNI URI Signing draft [draft-ietf-cdni-uri-signing] only supports query-string-based conveyance of the token.  The metadata element "package-attribute" was introduced to allow content service providers (CSPs) to select any query string parameter name they wanted, assuming that CSPs would be in the best position to select a low-collision-probability name; URISigningPackage is only the default name.

With respect to consecutive tokens, the CDNI URI Signing mechanism was designed to be stateless, so that consecutive tokens can be retrieved from different delivery nodes. As such, there is no relationship between consecutive tokens and token invalidation is solely based on the Expiry Time information element.

The CDNI working group appreciates the MPEG experts' thoughtful input and looks forward to continued collaboration with MPEG experts on URI Signing.

Our next meeting: IETF 95, April 3-8 2016, Buenos Aires, Argentina

[2012_09_28_OATC-OMAP_1-0] http://www.oatc.us/Portals/_default/Knowledgebase/1/2012_09_28_OATC-OMAP_1-0.pdf
[draft-ietf-cdni-uri-signing] https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/
[draft-brandenburg-cdni-uri-signing-for-has] https://datatracker.ietf.org/doc/draft-brandenburg-cdni-uri-signing-for-has/
[minutes-93-cdni] https://www.ietf.org/proceedings/93/minutes/minutes-93-cdni
[minutes-94-cdni] https://www.ietf.org/proceedings/94/minutes/minutes-94-cdni

> -----Original Message-----
> From: Kevin Ma J
> Sent: Tuesday, December 15, 2015 12:33 PM
> To: 'Ben Niven-Jenkins'
> Cc: cdni@ietf.org
> Subject: RE: [CDNi] Response to Liaison Statement on URI Signing
> 
> Hi Ben,
> 
>   will do.
> 
> thanx!
> 
> --  Kevin J. Ma
> 
> > -----Original Message-----
> > From: Ben Niven-Jenkins [mailto:ben@niven-jenkins.co.uk]
> > Sent: Tuesday, December 15, 2015 12:29 PM
> > To: Kevin Ma J
> > Cc: cdni@ietf.org
> > Subject: Re: [CDNi] Response to Liaison Statement on URI Signing
> >
> > Kevin,
> >
> > Looks fine to me.
> >
> > Only minor comment I have: At the end of the 3rd paragraph include a
> > reference to [draft-ietf-cdni-uri-signing] to make really clear which
> > document is the "main URI signing draft”.
> >
> > Ben
> >
> > > On 14 Dec 2015, at 20:07, Kevin Ma J <kevin.j.ma@ericsson.com> wrote:
> > >
> > > Hi All,
> > >
> > >  (as a chair) As per the Open Discussion action item from Yokohama
> [1],
> > the chairs have worked with Ray to draft a response to the MPEG liaison
> > statement on URI Signing [2].  Please find the response below, and feel
> > free to send comments to the list.  If there are no objections or
> > unaddressed comments by December 30th, we will send the official
> response
> > to MPEG.
> > >
> > > thanx!
> > >
> > > --  Kevin J. Ma
> > >
> > > [1] https://www.ietf.org/proceedings/94/minutes/minutes-94-cdni
> > > [2] https://datatracker.ietf.org/liaison/1434/
> > >
> > > -----
> > >
> > > From: Kevin J. Ma
> > >> From Group: CDNI
> > > To: Watanabe Shinji <watanabe@itscj.ipsj.or.jp>
> > > To Group: ISO-IEC-JTC1-SC29
> > > Title: Response to request for information on URI Signing 2015-11-02
> > > Response Contact: Kevin J. Ma <kevin.j.ma@ericsson.com>
> > > Technical Contact: Ray van Brandenburg <ray.vanbrandenburg@tno.nl>
> > > Purpose: In Response
> > > Body:
> > >
> > > The IETF CDNI working group would like to acknowledge our receipt of
> the
> > MPEG experts liaison letter and careful consideration during the 94th
> IETF
> > meeting.
> > >
> > > Having reviewed the Online Multimedia Authorization Protocol Version
> 1.0
> > (OMAPv1) specification [2012_09_28_OATC-OMAP_1-0], we understand the
> > proposed scope of usage for CDNI URI Signing to be the only as the
> Access
> > Token, as returned by the authorization server in step (E) of sections
> 2.3
> > and 2.4 of the OMAPv1 specification, to be use solely for authorizing
> > requests to the resource server (i.e., the CDN), as described in steps
> (F)
> > and (G) of sections 2.3 and 2.4 of the OMAPv1 specification.  We agree
> > that this is an exemplary use case for CDNI URI Signing with the Path
> > Pattern Information Element.
> > >
> > > At the 93rd IETF, the CDNI working group decided to remove text
> related
> > to signing of segmented content URIs from the CDNI URI Signing draft
> > [draft-ietf-cdni-uri-signing] in response to an IPR disclosure made
> after
> > the 92nd IETF [minutes-93-cdni]. The removed sections are currently
> > documented in a separate draft [draft-brandenburg-cdni-uri-signing-for-
> > has], as an extension to the main URI signing document. It should be
> noted
> > that at this point, that document is regarded as an independent
> submission
> > and IETF has not made a decision regarding its future status. At the
> 94th
> > IETF, it was agreed that the Path Pattern Information element was not
> > covered by the IPR disclosure and would be a useful feature for a number
> > of URI Signing use cases, including segmented content [minutes-94-cdni].
> > Path Pattern support will be reinstated in a future revision of the main
> > URI signing draft.
> > >
> > > With respect to long-lived tokens, as mentioned in the Security
> > Considerations section (9) of the CDNI URI Signing draft, increasing the
> > token validity period increases the potential for replay attacks,
> > including DoS attacks; however, nothing in the protocol prevents the use
> > of long-lived tokens.
> > >
> > > With respect to CDNs refreshing tokens, the CDNI working group
> discussed
> > mechanisms for signaling token refresh between CDNs and felt that the
> > required additional complexity of such a mechanism outweighed the cost
> of
> > regenerating the tokens. Note: Signaling between CDNs and clients is
> out-
> > of-scope for CDNI. As mentioned above, chained token support was removed
> > from the current CDNI URI Signing draft and there is no plan to
> reinstate
> > it in the main URI signing document due to IPR issues. As such, the
> topic
> > of token regeneration is limited to [draft-brandenburg-cdni-uri-signing-
> > for-has].
> > >
> > > With respect to name collisions, the current version of the CDNI URI
> > Signing draft only supports query-string-based conveyance of the token.
> > The metadata element "package-attribute" was introduced to allow content
> > service providers (CSPs) to select any query string parameter name they
> > wanted, assuming that CSPs would be in the best position to select a
> low-
> > collision-probability name; URISigningPackage is only the default name.
> > >
> > > With respect to consecutive tokens, the CDNI URI Signing mechanism was
> > designed to be stateless, so that consecutive tokens can be retrieved
> from
> > different delivery nodes. As such, there is no relationship between
> > consecutive tokens and token invalidation is solely based on the Expiry
> > Time information element.
> > >
> > > The CDNI working group appreciates the MPEG experts' thoughtful input
> > and looks forward to continued collaboration with MPEG experts on URI
> > Signing.
> > >
> > > Our next meeting: IETF 95, April 3-8 2016, Buenos Aires, Argentina
> > >
> > > [2012_09_28_OATC-OMAP_1-0]
> > http://www.oatc.us/Portals/_default/Knowledgebase/1/2012_09_28_OATC-
> > OMAP_1-0.pdf
> > > [draft-ietf-cdni-uri-signing] https://datatracker.ietf.org/doc/draft-
> > ietf-cdni-uri-signing/
> > > [draft-brandenburg-cdni-uri-signing-for-has]
> > https://datatracker.ietf.org/doc/draft-brandenburg-cdni-uri-signing-for-
> > has/
> > > [minutes-93-cdni] https://www.ietf.org/proceedings/93/minutes/minutes-
> > 93-cdni
> > > [minutes-94-cdni] https://www.ietf.org/proceedings/94/minutes/minutes-
> > 94-cdni
> > >
> > >
> > >
> > > _______________________________________________
> > > CDNi mailing list
> > > CDNi@ietf.org
> > > https://www.ietf.org/mailman/listinfo/cdni