Re: [Webpush] Vapid public key

Costin Manolache <costin@gmail.com> Wed, 02 November 2016 18:14 UTC

MIME-Version: 1.0
References: <CABkgnnVKd+kAZPD5KirF7NaGMDBSpaO6FR3yE8d+c3ge3-He3w@mail.gmail.com> <CAP8-FqmBUHd5up7Jfo+veFWvL22XiPwGGXNnOW6rm7nxeESU_g@mail.gmail.com> <CABkgnnX4aAjnZyu3morJOLatuuj9k4NSoTpoNtF7YjtRUFQOnQ@mail.gmail.com> <CAP8-Fq=Zd66ZhWm+gYesOpc2NZ-YBpy2+bHdr6O+h1KG2s16uw@mail.gmail.com>
In-Reply-To: <CAP8-Fq=Zd66ZhWm+gYesOpc2NZ-YBpy2+bHdr6O+h1KG2s16uw@mail.gmail.com>
From: Costin Manolache <costin@gmail.com>
Date: Wed, 02 Nov 2016 18:14:04 +0000
Message-ID: <CAP8-FqkfjQkm-z9HSBHMm3nht8SFBY5G=W82N8BAybbxucdEag@mail.gmail.com>
To: Martin Thomson <martin.thomson@gmail.com>
Content-Type: multipart/alternative; boundary=001a11397876a20e81054055686b
Archived-At: <https://mailarchive.ietf.org/arch/msg/webpush/X4j1OcQ8kvY2K-PjXJC2pNpXyms>
Cc: jr conlin <jconlin@mozilla.com>, "webpush@ietf.org" <webpush@ietf.org>, Peter Beverloo <beverloo@google.com>
Subject: Re: [Webpush] Vapid public key
Precedence: list

>From rfc2617 (digest auth):

Authorization: Digest username="Mufasa",
                 realm="testrealm@host.com".com",
                 nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
                 uri="/dir/index.html",
                 qop=auth,
                 nc=00000001,
                 cnonce="0a4f113b",
                 response="6629fae49393a05397450978507c4ef1",
                 opaque="5ccc069c403ebaf9f0171e9517f40e41"

On Wed, Nov 2, 2016 at 11:11 AM Costin Manolache <costin@gmail.com> wrote:

> IMHO the main problem with JWK is not size, but the inconsistency - would
> be good for the
> exact string used in subscribe() to also show in Authenticate.
>
> Any problem with using auth-param:
>
> Authorization: webpush JWTTOKEN, id=PUBKEY
>
> Costin
>
> On Tue, Nov 1, 2016 at 10:59 PM Martin Thomson <martin.thomson@gmail.com>
> wrote:
>
> On 2 November 2016 at 16:10, Costin Manolache <costin@gmail.com> wrote:
> > Authorization: webpush PUBLICKEY:JWT_TOKEN
>
> The grammar (RFC 7235) is:
>
>      credentials = auth-scheme [ 1*SP ( token68 / #auth-param ) ]
>      token68 = 1*( ALPHA / DIGIT / "-" / "." / "_" / "~" / "+" / "/" ) *"="
>
> With JWT, we've opted to use the "token68" form (also shown here).
> Given that base64url takes '-', '_', and '.', we could separate on
> '/'.  '/' is a valid base64 (the non-url-safe variant) character, but
> we could split on that.
>
> For existing implementations, you would have to accept that you are
> going to have to sniff for this, or we could use a new auth-scheme.  I
> think that sniffing should be workable given that you won't have a
> Crypto-Key header field.
>
> And before I forget, the ugliest option of all is to use JWK inside
> the JWT.  Here's an example of a JWK:
>
>
> {"crv":"P-256","ext":true,"key_ops":["verify"],"kty":"EC","x":"20zCfUuIs0NGtaVxENI4VH0YyJOUuxp973BTZTfhe1A","y":"WEMWyistS_sD6gGLN4IISWdIMQxZoCHAhlZ8zkmcVUI"}
>
> The ext and key_ops fields can be omitted safely - I just pulled this
> straight out of webcrypto - though it's still even bigger than you
> might like.
>
>

Re: [Webpush] Vapid public key Martin Thomson
Re: [Webpush] Vapid public key Costin Manolache
Re: [Webpush] Vapid public key Martin Thomson
Re: [Webpush] Vapid public key jr conlin
Re: [Webpush] Vapid public key Costin Manolache
Re: [Webpush] Vapid public key Costin Manolache
Re: [Webpush] Vapid public key jr conlin
Re: [Webpush] Vapid public key Costin Manolache
Re: [Webpush] Vapid public key Martin Thomson
Re: [Webpush] Vapid public key Martin Thomson
Re: [Webpush] Vapid public key Martin Thomson
Re: [Webpush] Vapid public key Costin Manolache
Re: [Webpush] Vapid public key Martin Thomson
Re: [Webpush] Vapid public key Costin Manolache
Re: [Webpush] Vapid public key jr conlin
Re: [Webpush] Vapid public key Costin Manolache
Re: [Webpush] Vapid public key jr conlin
Re: [Webpush] Vapid public key Martin Thomson