Re: [stir] WGLC: draft-ietf-stir-passport-rcd-09

[Ben Campbell <[e-mail]>]

As Chair, but speaking for just myself and not my co-chairs:  I agree with having the update available for the meeting. We’d like to close this out as soon as possible.

As individual: The responses to my comments all look good to me. One comment below on the data URI:

> On Jul 25, 2022, at 11:16 AM, Chris Wendt <[e-mail]> wrote:
> 
>> 
>> 
>> §6.1.2: “Even though this is probably not the typical case, an "rcdi" JSON pointer or integrity digest is optional if the image value is directly included via a data URI.”
>> 
>> Apologies, I should have caught this one in an earlier version. But wouldn’t a data: URL typically point to a body part that is not covered by the PASSporT signature? If so, it could be subject to tampering in route. Would that need integrity protection less than a HTTPS URL? I guess tampering would require an on-path attacker. But I am still skeptical of the exception unless the data: URL points to data covered by the PASSporT signature.
> 
> My understanding is that data URIs (rfc2397) always include the data inline, so would not be separate from the data:.  Here is an image example: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==
> 
> That said, i included an explicit reference to RFC2397.
> 

Oops, this was my mistake. I had the data URI scheme confused with the “reference another body part in a MIME multipart” URI scheme. Never mind.  (But the reference is good.)

Thanks!

Ben.