Re: [CDNi] URI Signing Shared Key Question

Hi Phil,

  The shared key redistribution problem only applies to DNS redirection?
So we'd essentially be saying DNS redirect needs to use asymmetric keys for
CDNI, but for non-CDNI cases (i.e., only one level of delegation) symmetric
keys are fine?

  (As an individual) That seems reasonable to me.

  I also do not know if that affects any production use cases and would be
interested in hearing from other WG members who have production insights.

thanx!

--  Kevin J. Ma

On Tue, Jan 4, 2022 at 7:43 PM Phil Sorber <sorber@apache.org> wrote:

> I got more pushback on this again, but I also got another suggestion. Not
> sure if I missed this before or not, but I was told by Ben Kaduk that he
> would be OK if we kept the shared key option for the "single-hop" case but
> removed the distributed case and thus removed the shared key distribution.
> Meaning if I just wanted to have someone internal to my company get access
> to the content I could create a shared key version that would validate.
> However, you would not be able to have a dCDN validate with a shared key.
>
> AFAIK, no proprietary implementation really touts that as a feature, but I
> may be way off base, so I wanted to get more feedback. Does this seem like
> a reasonable compromise?
>
> Thanks.
>
> On Wed, Nov 10, 2021 at 10:54 AM Kevin Ma <kevin.j.ma.ietf@gmail.com>
> wrote:
>
>> Hi All,
>>
>>   (As an individual) When we first started the draft, all the vendors
>> were using shared keys, so it was natural to have that as a feature to ease
>> migration and improve adoption.  It looks like shared keys are still used
>> in other URI signing schemes today, so I can only assume it is still a
>> desirable feature, even if it is not secure (along with the other known
>> caveats about the security of URI signing in general).  I could go either
>> way on this one.  We're not preventing anyone from using shared keys, but
>> we may reduce adoption if it is not readily apparent how to use them.  It's
>> a similar argument to the client IP question: are users better off with URI
>> signing with a shared key than some other proprietary protocol (not vetted
>> by secdir) that more readily fits their use case?  I would lean toward
>> stronger language about it being not recommended.
>>
>> thanx!
>>
>> --  Kevin J. Ma
>>
>> On Tue, Nov 9, 2021 at 5:39 PM Phil Sorber <sorber@apache.org> wrote:
>>
>>> This is one of three questions that I had after last call feedback. I'd
>>> like to hear any opinions on the matter from the working group. I will be
>>> pointing to this thread for explanation/justification about the changes or
>>> lack thereof to the document. Thanks.
>>>
>>> Do we want to remove text about Shared Key support in favor of a smaller
>>> comment about how it's possible to do for an internal use case, but not
>>> condoned or recommended by the document, or do we want to keep it as is and
>>> cite having niche value and make sure we have strong language about the
>>> dangers of using it?
>>> _______________________________________________
>>> CDNi mailing list
>>> CDNi@ietf.org
>>> https://www.ietf.org/mailman/listinfo/cdni
>>>
>>