[Rats] Re: Hint Discussion in CSR Attestation Draft

[Hannes Tschofenig <[e-mail]>]

Hi Michael, Hi Carl,

 

I am fine with changing it to an FQDN. This will make processing simple and deterministic.

 

If we think about how AAA routing* works, there we also have a NAI with a domain part that is used for routing. The equivalent of the username part of the NAI would in this context be found in the attestation evidence. At least for EAT this is the case and I hope this is also true for other Evidence formats. In https://www.ietf.org/archive/id/draft-ietf-rats-reference-interaction-models-09.html#appendix-A, Henk added also a username equivalent into the protocol in form of a key id.

 

Ciao
Hannes

 

*: This is just my mental model of how I see this working. I am not proposing to replicate AAA routing.

 

 

 

Gesendet: Sonntag, 23. Juni 2024 um 21:34 Uhr
Von: "Michael Richardson" <[e-mail]>
An: "Carl Wallace" <[e-mail]>, "[e-mail]" <[e-mail]>, "rats" <[e-mail]>
Betreff: [Rats] Re: Hint Discussion in CSR Attestation Draft

Thomas Fossati wrote:
ts> You wouldn't. The hint is a routing label that is used by the relying
ts> party to decide which verifier to contact for handling this specific
ts> piece of attestation evidence. When evidence reaches the verifier the
ts> hint is no more.

Carl Wallace <[e-mail]> wrote:

CW> OK, so relying party, not verifier. How would the relying party use a
CW> "free form" label to route anything?

I admit that I'm not keen about the free-form-ness of the hint.

I guess I'd rather it was specified as a URI, with ni:, or something like
that being the default string-like thing that one just strcmp() against a
configuration file. That way, once we figure out what we really want,
intepreting it as a URI will already be established.
(I see in the URI list, no uuid:, but also secondlife: ha)



--
Michael Richardson <[e-mail]> . o O ( IPv6 IøT consulting )
Sandelman Software Works Inc, Ottawa and Worldwide




_______________________________________________
RATS mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]