Re: [Unbearable] WGLC 3 on core documents

[Andrei Popov <[e-mail]>]

Without “different servers”, it is not clear what these keys are supposed to be different from. ☺

How about this:
“In order to prevent cooperating servers from linking user identities, the scope of the Token Binding keys MUST NOT be broader than the scope of the tokens, as defined by the application protocol.”


From: Brian Campbell [mailto:[e-mail]]
Sent: Thursday, March 2, 2017 5:44 AM
To: Martin Thomson <[e-mail]>
Cc: Andrei Popov <[e-mail]>; Leif Johansson <[e-mail]>; [e-mail]
Subject: Re: [Unbearable] WGLC 3 on core documents



On Wed, Mar 1, 2017 at 4:43 PM, Martin Thomson <[e-mail]<mailto:[e-mail]>> wrote:
On 2 March 2017 at 08:21, Brian Campbell <[e-mail]<mailto:[e-mail]>> wrote:
>> I believe there was some opposition to MUST, for deployments where the
>> client has knowledge of the cooperating servers. If nobody opposes a switch
>> to MUST, I think it may be a good change to make.
>
>
> Yes there's a desire for the allowance of different scoping rules for
> application protocols where there's already knowledge of the cooperating
> servers and/or correlatable info is already being sent in a token to
> different servers.

That's not an argument for SHOULD, that's an argument for flexibility
in scoping rules, which you already have.  Since the application
protocol determines the scoping rules, you can let the MUST stand and
define scoping rules for the application protocol that suit your
needs.

Yes it's an argument for flexibility. My concern is with how the text might be interrupted. With the SHOULD to MUST change you're suggesting, it would say,

 "In order to prevent cooperating
   servers from linking user identities, different keys MUST be used
   by the client for connections to different servers, according to the
   token scoping rules of the application protocol."
And I worry that some will zero in on the "different keys MUST be used by the client for connections to different servers" and take it very literally (especially the "to different servers" part) and out of context of the rest of the sentence that qualifies it with respect to the application protocol token scoping rules. Maybe that worry is unfounded but having it be SHOULD felt like it helps give that flexibility.
I take your point though.
What if it just said,

 "In order to prevent cooperating
   servers from linking user identities, different keys MUST be used
   by the client, according to the
   token scoping rules of the application protocol."
taking the "different servers" bit out?