Re: [POSH] Delegation duration

[Peter Saint-Andre <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 9/17/13 10:34 AM, Matt Miller (mamille2) wrote:
> 
> On Sep 17, 2013, at 9:04 AM, "Olle E. Johansson" <[e-mail]> 
> wrote:
> 
>> 
>> 17 sep 2013 kl. 14:46 skrev Michael Procter
>> <[e-mail]>:
>> 
>>> Thanks for issuing -01, which addresses some of my questions. 
>>> I'm still concerned about one area though.  To repeat from an 
>>> earlier email:
>>> 
>>>> In section [7], you state that ideally, caching of the 
>>>> certificate obtained via POSH should be based on the
>>>> expiration time of the certificate.  I think this might be a
>>>> little too trusting, as it ties delegation validity to
>>>> certificate expiry. If I trust hosting.example.net to host my
>>>> service today, that doesn't mean I will continue to trust
>>>> them until their certificate expires.  HTTP cache-control
>>>> headers might be a useful way of indicating a short term
>>>> trust though.
>>> 
>>> I think it would be useful to consider adding a "validity"
>>> field somewhere, indicating either a duration (this delegation
>>> valid for 24 hours) or an expiry (this delegation valid until
>>> 17th Sep 2013).  Whether this is done via cache-control
>>> headers, or a new field in the jwk, or some other mechanism is
>>> less important to me, so long as there is some way of
>>> indicating how soon the delegation may be revoked.
>>> 
>> Caching to expiry time is not acceptable. I do agree that we
>> need to have a header to define a decent caching time.
>> 
> 
> I can see value in a duration/TTL, as long as that duration is
> short (IMO, at most 24 hours).  It's fairly easy to maintain in
> deployment, and provides the practical benefit we're looking for.
> 
> I also think an absolute expires is a bad idea. Given that I think
> we want very short durations, an absolute expires time means the 
> document needs to be continuously updated, which increases the
> burden on deployments.

Agreed on the foregoing.

> I will confer with my co-author on this, but I think putting 
> something in the POSH document is the most pragmatic approach.

Yes, as long as when you say "the POSH document" you mean the hosted
JSON file, not the Internet-Draft. :-)

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/


-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJSOMjFAAoJEOoGpJErxa2pcoYP/3Y1G6DMJ1usZ/US7YFHryXQ
IljbZDcNhmQxlDWQmgCsoU5P/5IWsDEkHveRk7apAmpFOx4rwnkvfssCIEbzooGw
ughKi/CTYQzxU/8hcHC+UUa1PVq3/b9yBgJDiw3Flpfytv12Bb2YwI2HED1qef9A
PHNOHUgxYSKoj7QJMKVjyLGAzi2Fb52w09asUim/WcDbOQdvOhHTkV8oMZK8V2Ce
jNEdV9ILTyDfSky2jOTpTLGy7TN44kee7i6p81GbgVTYnkeQC3P1Ev2aEA0Fiee7
TrUAkH+Fb8mYUa92ZOJ7TsQYRjXleYwpHekb5dhR8yOf1GlnImlEHcgNMG7drrEg
g/CMdmsRll1F61GrrjaYNaqiAZ0vN7xpuX/X7NoEnIhLQIF+j84oyUsccVq8p/gv
L54M6QN/tprsqWlh7m2C67eMs/vdMQA1YrjVcGZZF64sJA0u29Oa81xEVh7PPW3X
UHfg54gtsDXPsgXlUJs06UG2SgUpPMO8577wBkTxAiUDvOkSxXa8cOq2/cs7huEf
NdLDwKD48RgcC9Plh0DJP7ULBJt/qBEoCW1Cc1OKF7MeaeKdQMPLqY6U/SqQzdZp
KBjwUackBzSSLQZ8ZcET9QJ5jRoj5V/g/nqdnysZgFHoRdSmKcUa8kU+F3M0cyZz
F74wN9KbtgBzjOAWSKoi
=jHNS
-----END PGP SIGNATURE-----