Re: [core] Tossing around URIs to use outside an application

[Christian Amsüss <[e-mail]>]

Hi,

> I think that the discovery/dynlink process should create a channel
> towards the target.  The channel might include clues, like those returned by DANE.

Agreeing. The URI should suffice -- but if the linking page so happens
to send hints (be they DANE records volunteered over DoH, or something
COSEish in a more constrained-oriented data model), they allow saving
some round-trips.

(Same should, by the way, go for protocol negotiation).

> If we want to avoid disclosing the URL that we using and then get the 4.01,
> then we should doing an opportunistic EDHOC to get privacy.  How (and if)
> that is authenticated is something we should discuss.

*That* is maybe where "is application specific" comes in -- the client
application needs to know at some point whom it may disclose its
operation to:

* the public, doing an exploratory unprotected GET,
* only active attackers, when doing opportunistic EDHOC,
* or only the authenticated server that is authorized to see the
  request, in which case eligible trust roots and kinds of edges there
  have to be configured.

Thanks
c

-- 
To use raw power is to make yourself infinitely vulnerable to greater powers.
  -- Bene Gesserit axiom