Re: [Webpush] Ben Campbell's Discuss on draft-ietf-webpush-vapid-03: (with DISCUSS and COMMENT)

Martin Thomson <> Thu, 17 August 2017 01:01 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 438F613239D; Wed, 16 Aug 2017 18:01:05 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id zLulc9w7rN6L; Wed, 16 Aug 2017 18:01:03 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4001:c0b::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 3323612EC06; Wed, 16 Aug 2017 18:01:03 -0700 (PDT)
Received: by with SMTP id m34so24584101iti.1; Wed, 16 Aug 2017 18:01:03 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=HfuCURT0Fb+lR5ZMYekIKg6nzeT6r13KYJXXO8YtKjg=; b=oP55sJaVKMV7bDfnpQOFI43rNKsaODwn8yskURjjWOGTxcgMkBRnquQ+7OasQYLR1n E+uyJblILfIWyEJmcxhinn8LrAg3s80/RFXyrYC1hll8Gw+gGut3EC7EWkrTOlDoogBH Hs+wjUH6Z2hiPPOmX7v8z1U+dqP7AP0y34eyd8vNtPPPmIXc2y5DEOnhahGGfePjlyeE 8/9ki0PEsltcDZ6Z0BoSlhoS0Q7ninmX0EVXI55ZJRbsPGvRHCcpOnJ7ZZ563fGZgBoU rPLF054JDdWnIBdNLROpLfZkvLl4bm2aFL9Ygr86hlH3SdcssMfoqppv1S9dYpJu7guY XaSw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=HfuCURT0Fb+lR5ZMYekIKg6nzeT6r13KYJXXO8YtKjg=; b=MqBI7VrIyO1zLoWGnv9ref4xQIjTmIZO7LaNZ2BYv3Pflc2YYLdmEueNRZ6BpYrNFO IYBFi9gQ4FZlSx+tkQQFIt8pYlN5DrIaUlaIF5Ymp940Eh1qfjx51vTEq+dQEcJxtc/G 8VZYNrDCOaq4JlVRf3WnGoTXGklDyyQjodwLLY8bOa0Cmc30ir4Ne+WqSjlx8q19686N 8Qkxm6Rr+FIvXJ7yGchAVzCKRaUvvKPg+QtHQZJz7L67Ag/1QIebh0OSoqygGGexIKcs 4sYmlI9l1Wwe4VHscnNJTx48JyqgBsbmq5WtGsmtzq0GV33AP3MY15GvUqhEsfJUrjTC 14Dw==
X-Gm-Message-State: AHYfb5j9tFxhQcajDJHDz4w5U59nFCeQebSUc3J6TByNNayg9IIgCUXo /I666nB4tA0VupmFtTFBLISL78zDkg==
X-Received: by with SMTP id e190mr312646itg.122.1502931662535; Wed, 16 Aug 2017 18:01:02 -0700 (PDT)
MIME-Version: 1.0
Received: by with HTTP; Wed, 16 Aug 2017 18:01:02 -0700 (PDT)
In-Reply-To: <>
References: <> <> <>
From: Martin Thomson <>
Date: Thu, 17 Aug 2017 11:01:02 +1000
Message-ID: <>
To: Ben Campbell <>
Cc: The IESG <>, draft-ietf-webpush-vapid <>, Phil Sorber <>,, "" <>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <>
Subject: Re: [Webpush] Ben Campbell's Discuss on draft-ietf-webpush-vapid-03: (with DISCUSS and COMMENT)
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Discussion of potential IETF work on a web push protocol <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 17 Aug 2017 01:01:05 -0000

On 17 August 2017 at 01:52, Ben Campbell <> wrote:
> That mostly looks good, modulo discussion below. I think you dropped the word “meaning” from the 8174 (was 2119) reference. Also, that RFC recommends specific boilerplate. (I’m not going to get wrapped around whether you use that specific boilerplate, as long as the meaning is clear.)

The master branch has the boilerplate.  I have updated the PR, which
no longer includes a change.

>> I think that "MAY" is entirely appropriate given the non-blocking
>> nature of the mechanism. A push service might look at the header
>> field, but not require the token. Maybe they just wanted to attach an
>> email address to a stream of messages (that's what we do).
> I think there’s a fundamental difference between not validating in the first place, and ignoring a failed validation. My point is not to say that ignoring it is the wrong thing to do, just that I think some more elaboration here is needed. Would it make sense to say something of the effect of “SHOULD NOT use the information from a token that has failed validation”?

That's easy.  MUST NOT even.  I added:  "A push service MUST NOT use
information from an invalid token."

>> In NSS and many elliptic curve libraries, you can create an EC key for
>> P-256.  You can then use that key for signing AND key exchange.  You
>> shouldn't though.
> Would it make sense to say “Some library implementations…”?

The PR says "Some elliptic curve implementations ".  I think that's better.

> Oops, that was a cut and paste error. I meant to quote the following sentence:
> " A push service MAY reject a
>    message that includes invalid credentials with a 403 (Forbidden)
>    status code. "

I'll respond below.

>>  This section defines behaviour in the case that a
>> subscription is limited to a particular application server key.  I
>> realize now that this might have been unclear, so I have reworded to:
>> "A push service MUST reject a message sent to a restricted push subscription if
>> that message includes no "vapid" authentication or invalid "vapid"
>> authentication.  A 401 (Unauthorized) status code might be used if the
>> authentication is absent; a 403 (Forbidden) status code might be used if
>> authentication is invalid."
>> This also allows me to clear up a minor gripe about the prescriptive
>> nature of the text regarding status codes.
> I like that paragraph better, but does it conflict with the text in section 2, as discussed in my DISCUSS?

The key point here is that the rejection mandated in Section 4.2 is
specific to *restricted* subscriptions.  The text in Section 2 (above)
is a more general statement.  I don't think that the two are in

> I’ll go with Alexey’s separate response. That is, never mind.