Re: [websec] Well-known URIs

[Yoav Nir <[e-mail]>]

Hi Chris

On Aug 8, 2013, at 10:31 PM, Chris Palmer <[e-mail]> wrote:

> On Thu, Aug 8, 2013 at 5:35 AM, Mark Nottingham <[e-mail]> wrote:
> 
>> 1. Well-known URIs are designed for cases where the client wants to get a bunch of *related* data together; as such, a general framework is encouraged, as long as the use cases are similar.
>> 
>> This is why I don't like hostmeta; it's a bucket for anything you want to throw in there, which means that over time, the client will be getting a lot of information they don't want, which will necessitate a query language, which is just nasty overkill. At the other end of the spectrum, having a single-use well-known URI in the critical path (or even not) for a browser is similarly Not A Good Idea.
> 
> Can you say clearly what else we should stuff into the W-K URI for
> HPKP? What other working groups and standards bodies are we going to
> have to reach consensus with?

The answer to those questions is "nothing" and "none".

let's assume the format is JSON, we could call the resource https://www.example.com/.well-known/TransportSecurity.json , and it could be formatted like this:
{
    "HPKP": {
        "max_age": 2592000,
	"include_subdomains": "false",
	"pins": [
            {
                "alg": "sha1"
                "hash": "aQWqfl0MQRwcM+3uffZ08Rttods="
            },
            {
                "alg": "sha256"
                "hash": "Lbl5D9eR4PLiaOUSeO6sue2QrSvpB31F4mte/4D75xM="
            },
        ]
    }
}

Then if someone wants to add HSTS into this, they're welcome to it, but they'll need their own document to do it.

Yoav