[Rats] Re: Hint Discussion in CSR Attestation Draft

[Carl Wallace <[e-mail]>]

Inline replying to MCR and Hannes' subsequent reply...

On 6/23/24, 3:34 PM, "Michael Richardson" <[e-mail] <mailto:[e-mail]>> wrote:




Thomas Fossati wrote:
ts> You wouldn't. The hint is a routing label that is used by the relying
ts> party to decide which verifier to contact for handling this specific
ts> piece of attestation evidence. When evidence reaches the verifier the
ts> hint is no more.


Carl Wallace <[e-mail] <mailto:[e-mail]>> wrote:


CW> OK, so relying party, not verifier. How would the relying party use a
CW> "free form" label to route anything?


I admit that I'm not keen about the free-form-ness of the hint.


I guess I'd rather it was specified as a URI, with ni:, or something like
that being the default string-like thing that one just strcmp() against a
configuration file. That way, once we figure out what we really want,
intepreting it as a URI will already be established.

[CW] This may or may not hold depending on how "what we really want" shakes out. This is why I suggested earlier just sticking an extensibility point here instead of the current hint field. Assuming the free-form aspect is eliminated, there needs to be some new text added to inform what state the generator is expected to have and what state the relying party is expected to have to work with this field (i.e., baked in values, configuration file, etc.).

(I see in the URI list, no uuid:, but also secondlife: ha)






--
Michael Richardson <[e-mail] <mailto:[e-mail]>> . o O ( IPv6 IøT consulting )
Sandelman Software Works Inc, Ottawa and Worldwide