Re: [Webpush] AD Review of draft-ietf-webpush-vapid

[Martin Thomson <[e-mail]>]

On 15 June 2017 at 10:09, Adam Roach <[e-mail]> wrote:
>> As you say, an application server doesn't really have any way of
>> determining that the push service supports a given algorithm.  That
>> means we need to be very careful about how we signal these things.
>> Using the authentication scheme (in this document, "vapid") as the
>> extension point means that we can use the existing mechanisms in HTTP
>> to signal which scheme is supported if it ever comes to the point
>> where we want to or are forced to deploy a new algorithm.
>
> Sure. Can the document say this?

https://github.com/webpush-wg/webpush-vapid/pull/35


>> We also have the option of replicating the supportedContentEncodings
>> parameter of PushManager in the API
>> (https://w3c.github.io/push-api/#pushmanager-interface) so that
>> applications might avoid that round trip.
>
>
> ...and that's much better (presuming you intend to *add* something rather
> than shoehorning signature algorithms into a list intended for encryption
> algorithms). Is there anything we can do now to lay the groundwork for that?

https://github.com/w3c/push-api/pull/262

That's not this document, but it closes the loop.

> Is the application server identification mechanism described in this
> document intended to *ever* be useful WITHOUT using the Subscription
> Restriction mechanism described in section 4?

The document addresses two use cases: subscription restriction and
self-identification.  The former most certainly relies on the
signature.  The latter is almost served by having the JWT payload in
the request, but we did agree that key continuity is an part of that
use case.  That means that the push service relies on the signature
for establishing continuity of identity.  It's hard to build up a
reputation as an upstanding application server when anyone can
trivially pretend that they are you.

Those two use cases are intended to be exhaustive.

For the reputation part, I believe that it is acceptable for key
rotation to result in loss of reputation, but it's probably worth
making an explicit note of the consequences:

https://github.com/webpush-wg/webpush-vapid/pull/36

> I don't care about the name, and what you propose is a fine shade for this
> shed. It would be worth noting that future documents may add more fields to
> the schema, and that they will do so by updating this document (along with
> the requisite "ignore fields you don't know" language).

https://github.com/webpush-wg/webpush-vapid/pull/34