[saag] draft-farrell-decade-ni-09

[Hannes Tschofenig <[e-mail]>]

Hi all, 

I don't really know what the right place is to discuss this document. Hence, I trying the saag mailing list. 

I read through the document and my impression is that it tries to accomplish a little bit too too much. 

As a high level comment you cannot make an assumption about what information is hashed. Another specification is needed to explain the semantic and these other documents exist. For example, I had asked on the TLS mailing list whether we should use this document to convey fingerprints of raw public keys (which come in form of a SubjectPublicKeyInfo in our case). 

This has an impact on the security consideration section, the hash algorithm registry, and various statements made in the document. 

For example, the statement that "... the hash SHOULD be calculated over the public key in an X.509 SubjectPublicKeyInfo structure..." isn't really useful when the document aims to provide hashes of all sorts of objects and some might not even be X.509 certificates at all. 

The encoding of the URI also seems a bit strange. It seems that you have started with the Web use case and then though "Cool. This could be useful in other protocols as well.". But the problem is that other protocols have their own encoding. For example, in the TLS out-of-band validation mechanism there is no internationalization issue nor a need to do a base64 encoding. The binary encoding falls into that category as well.  

The .well-known seems to me pretty unrelated to this specification and may have sneaked into the document as part of the Web use case. 

The security consideration is a collection of random thoughts. I have difficulty understanding what is being said there. There are in general two problems to come up with a meaningful text. The first problem is related to the generic nature of your document: it makes a difference what you hash. To pick the TLS oob validation document again there we have a hash of the public key. In other cases you are talking about hashing some file or other objects. Then, the second problem is that you do not know what is done with the hash as part of the overall protocol interaction of the application that is using your URI scheme. So, in the TLS oob validation draft the hash of the public key is associated with the public key cached from an earlier exchange and is also linked to the private key that is then used in the TLS handshake. In other applications the hash just be used to point to some state information that is retrieved. 

In a nutshell, there is room to simplify the document. 

Ciao
Hannes

PS: I am not sure what you are trying to accomplish with the Content Type Query String.