[Privacy-pass] Privacy Pass draft comments

[Ben Schwartz <[e-mail]>]

Some comments on the drafts scheduled for discussion in our session next
week:

On the architecture:
The draft mentions a use case for "1 bit of metadata" without further
explanation.  Is this in reference to the PMBToken proposal?  I think it
would be worth clarifying the reference.

Regarding PMBToken, I'm not sure that proposal necessarily reduces the
anonymity set in the way that the architecture draft describes.  It sounds
like the server returns either a valid token, which the server can later
verify, or an invalid token, which the server cannot distinguish from
client-generated garbage.  If so, we might avoid reduction of client
anonymity by encouraging all clients to attempt to send garbage tokens
occasionally.  "Don't Take Any Wooden Nickels" [1].

On the HTTP API:
There's no explanation of why this is all being jammed into a
Sec-Privacy-Pass header.  This is very much unlike a typical REST API.
What's the goal here?  I think it would be worth clarifying.

If this design is to allow tacking redemptions onto arbitrary HTTP requests
like a cookie, then could issuance still be a normal REST API?  Then we
probably wouldn't need the "type" field for redemption; it could be
implicit.

--Ben

[1] https://en.wiktionary.org/wiki/don%27t_take_any_wooden_nickels