Re: Standardizing Firefox's Implementation of Link Fingerprints

Simon Josefsson <simon@josefsson.org> Tue, 03 July 2007 09:13 UTC

Return-path: <discuss-bounces@apps.ietf.org>
Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1I5eSH-0000wj-Lw; Tue, 03 Jul 2007 05:13:53 -0400
Received: from discuss by megatron.ietf.org with local (Exim 4.43) id 1I5eSG-0000wX-0T for discuss-confirm+ok@megatron.ietf.org; Tue, 03 Jul 2007 05:13:52 -0400
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1I5eSF-0000wJ-JK for discuss@apps.ietf.org; Tue, 03 Jul 2007 05:13:51 -0400
Received: from vinyl.extundo.com ([83.241.192.59]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1I5eSB-0006SL-3p for discuss@apps.ietf.org; Tue, 03 Jul 2007 05:13:51 -0400
Received: from mocca.josefsson.org (38.177.241.83.in-addr.dgcsystems.net [83.241.177.38]) (authenticated bits=0) by vinyl.extundo.com (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id l639DPCf006031 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 3 Jul 2007 11:13:32 +0200
From: Simon Josefsson <simon@josefsson.org>
To: "Edward Lee" <edilee@mozilla.com>
Subject: Re: Standardizing Firefox's Implementation of Link Fingerprints
References: <dc07ed930707021624h25cb377dm1feb52d4dc02c2a8@mail.gmail.com>
OpenPGP: id=B565716F; url=http://josefsson.org/key.txt
X-Hashcash: 1:22:070703:edilee@mozilla.com::6Cc9mLZA5U7KBMY2:2vmd
X-Hashcash: 1:22:070703:discuss@apps.ietf.org::sqgWrJw/klUBHRg3:3Sth
Date: Tue, 03 Jul 2007 11:13:25 +0200
In-Reply-To: <dc07ed930707021624h25cb377dm1feb52d4dc02c2a8@mail.gmail.com> (Edward Lee's message of "Mon, 2 Jul 2007 16:24:10 -0700")
Message-ID: <871wfp3l56.fsf@mocca.josefsson.org>
User-Agent: Gnus/5.110007 (No Gnus v0.7) Emacs/22.0.95 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Spam-Score: 0.1 (/)
X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581
Cc: discuss@apps.ietf.org
X-BeenThere: discuss@apps.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: general discussion of application-layer protocols <discuss.apps.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/discuss>, <mailto:discuss-request@apps.ietf.org?subject=unsubscribe>
List-Post: <mailto:discuss@apps.ietf.org>
List-Help: <mailto:discuss-request@apps.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/discuss>, <mailto:discuss-request@apps.ietf.org?subject=subscribe>
Errors-To: discuss-bounces@apps.ietf.org

"Edward Lee" <edilee@mozilla.com> writes:

> https://people.mozilla.com/~edilee/draft-lee-uri-linkfingerprints-00.txt

I believe standardizing this would be useful.

There is another use case for this idea: referencing X.509 certificates.
Some protocols -- TLS client_certificate_url extension, and the DNS CERT
resource record -- already have support for something similar, where a
URL needs to be accompanied with a hash in order to be useful.  Placing
the hash value in the URL itself is a simple improvement, and will
simplify future protocols that want to do similar things as TLS/CERT.
These future protocols can have only a URL field, and require that the
URL contains a linkfingerprint.

An origin of the hash-value-in-URL idea is the WTLS, if you can find a
reference to it, it may be useful to add a informative reference to it.
There may be other similar examples too, but I don't know of any earlier
one.

/Simon