Hi Dale,
On 06/12/2012 03:04 PM, Worley, Dale R (Dale) wrote:
Having never heard of this proposal before, I found the concept
interesting, but the exposition in the draft was difficult to grasp in
certain places. I believe that it is because the text assumes that
the reader already knows the underlying theory of what the process is
intended to accomplish.
I'm not sure there's a theory:-)
For example, in section 3, the syntax of the "ni" URI scheme is
spelled out with admirable clarity and exactness, including:
Digest Value [Required] The digest value MUST be encoded using the
base64url [RFC4648] encoding.
Hmmm, "the digest value"... The digest value *of what*?
The input to the digest is not defined by this draft, except
in the case of public keys. (See other comments wrt MIME &
Content Type as well.)
"Other than in the above special case where public keys are used, we
do not specify the hash function input here. Other specifications
are expected to define this."
Considering the previous section 2, it seems that there is some
implicit string, which when hashed by the algorithm specified in the
"Digest Algorithm" part, produces the "Digest Value". And given the
discussion, it seems that this string is an *input* to the process of
generating an ni URI, and that the ni URI is really a way of encoding
this string. The string itself is specified by some external reality,
and seems to be expected to represent or specify some object in some
way, and thus the ni URI is a "name" for that object.
So far, so good, although it would have been better if this was
spelled out explicitly.
Going back to section 2 for a moment, there is:
When the input to the hash algorithm is a public key value, as may be
used by various security protocols, the hash SHOULD be calculated
over the public key in an X.509 SubjectPublicKeyInfo structure
(Section 4.1 of [RFC5280]).
I can see what this means, but it's not very clear. A better way to
write it would be:
When the input is intended to be a public key value, as may be
used by various security protocols, the input to the hash SHOULD
be an X.509 SubjectPublicKeyInfo structure (Section 4.1 of
[RFC5280]) containing the public key rather than the public key
value itself.
Have to say I prefer the existing text.
In section 8 is:
The following ni URI references the text "Hello World!" (without the
quotes, being 12 characters), [...]
But the term "references" seems not to have been used in this sense
before in the draft. More clear would be:
The following ni URI is generated from the string "Hello World!"
(without the quotes, being 12 characters), [...]
Ack. Thanks.
Unfortunately, the example is somewhat incongruous, as "Hello World!"
is not obviously a name or reference to any object.
In this case the object named is just those 12 characters.
Thus while it
still is clear how it can be input to the processes that are described
in the draft, it doesn't seem to be a conceptually typical example.
Well, I could have said a file that contains "Hello World!" (12 chars:-)
But I don't think its much clearer, maybe less.
Then we get to:
Given the SubjectPublicKeyInfo in Figure 6 we derive the names shown
in Figure 7 for this value.
I can't tell what this means. What is "this value"? Is it the
immediately preceding URI
(http://example.com/.well-known/ni/sha-256/f4OxZX_x_FO5LcGBSKHWXfwtSx-j1ncoSt3SABJtkGk)?
In what manner does the "given" SubjectPublicKeyInfo affect the names?
No, the input value is the DER encoding of the SPKI as stated earlier.
I guess the following is a little more correct so I've changed it to:
Given the DER-encoded SubjectPublicKeyInfo in Figure 6 we derive
the names shown in Figure 7 for this value.
If the input value was meant to be the SubjectPublicKeyInfo itself,
the sentence would not add "this value", which strongly suggests a
*different* value than the one mentioned just before in the same
sentence. Rather, one would say:
We derive the names shown in Figure 7 from the SubjectPublicKeyInfo
in Figure 6.
I don't get the difference to be honest.
Cheers,
S.
Dale