Re: [Secdispatch] Oblivious HTTP charter draft

On Thu, Mar 18, 2021 at 12:24:33PM +1100, Martin Thomson wrote:
[...]
> The OHTTP working group will define the Oblivious HTTP protocol, a method of encapsulating HTTP requests and responses that provides protected, low-latency exchanges. The working group will define any encryption scheme necessary and supporting data formats for carrying encapsulated requests and responses, plus any key configuration that might be needed to use the protocol.

What does it mean to "define an[y] encryption scheme"?

> The OHTTP working group will include an applicability statement that documents the limitations of this design and any usage constraints that are necessary to ensure that the protocol is secure.

Is this intended to be an Applicability Statement as defined in RFC 2026?

> The working group will define a format for any encryption keys that are needed. The working group will not describe how encryption keys are obtained. The working group will not define any methods for discovering proxy or server endpoints; specific uses of the protocol will need to describe discovery methods or rely on configuration.

Why do we need new formats for encryption keys?  Don't we already have a
bunch of those?  Defining how to obtain keys is necessary, of course.

Thanks,

Ben

> The OHTTP working group will work closely with other groups that develop the tools that OHTTP depends on (HTTPbis for HTTP, CFRG for HPKE) or that might use Oblivious HTTP (DPRIVE for DNS over HTTPS).
> 
> The working group will use draft-thomson-http-oblivious as input.
> 
> _______________________________________________
> Secdispatch mailing list
> Secdispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/secdispatch