Subject: Re: [Acme] Immutable authorizations list

From: Fraser Tweedale <[email-masked]>
Date: Wed, 30 Nov 2016 14:25:21 +1000

On Tue, Nov 29, 2016 at 04:32:33PM -0500, Richard Barnes wrote:
> On Tue, Nov 29, 2016 at 4:14 PM, Jacob Hoffman-Andrews <[email-masked]> wrote:
> 
> > Currently we have this text:
> >
> > > The elements of the "authorizations" array are immutable once set. If
> > any change is made to the array after the object is created, the client
> > MUST consider the application invalid.
> >
> > What's the purpose of this clause? I'd like to strike it if possible.
> >
> 
> The idea is that the client should get the full list of authorizations to
> complete in the first shot, so that it doesn't have to keep going back to
> the order and seeing if it has to do more stuff ad infinitum.
> 
> (Note to self: Change "application" to "order" in the PR)
> 
> 
> > Rationale: The most straightforward way to render a pending order object
> > is going to be by querying a database for the most recent authorizations
> > applicable to the names in the CSR (preferring valid authzs), and
> > generating links to those authorizations. In general this should provide
> > a stable list of URLs, but may produce changes in some edge cases- for
> > instance, if one authz expires and a newer order is created with an
> > overlapping identifier.
> >
> > Is there a benefit to having the client consider the application invalid
> > in such a case?
> >
> 
> I think so, because it's not distinguishable from the above case.  It might
> seem like it only costs the client a GET (to fetch the authz and see that
> it's valid), but finding what's new and checking on it requires non-trivial
> logic.  And that logic would still be required even if you said that
> servers could only change from one valid authz to another.
> 
> An implementation such as you describe would also violate the semantics of
> the "authorization" field.  The authorizations listed are supposed to be
> those that the CA used to issue the certificate.  Note the past tense
> there; these are the authorizations that were considered at the time of
> issuance, not now.  So replacing them with updated ones is not helpful.
> 
> --Richard
> 
There are (presumably) going to be many more client implementations
than server implementations.  With the current language, the client
must check that authorizations have not changed.

The language for the server should be ``MUST NOT change the elements
of the "authorizations" array once set.'', unambiguously putting the
responsibility where it squarely belongs - with the server.  The
spec could further elaborate that clients ``SHOULD consider the
application invalid'' if a change is detected.

I see no reason why clients should be burdened (by way of ``MUST'')
with detecting a condition that will not arise with compliant
servers, and is unlikely to cause practical issues if it does occur
after a certificate has been issued.

Thanks,
Fraser

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Fri, 2 Dec 2016 10:30:09 -0800

> Richard Barnes wrote:
Okay, I'm convinced that the server should take steps to make sure the
list is immutable, however:

> after a certificate has been issued.
I agree with this. This makes sense as a server requirement rather than
a client requirement.

---

From: Richard Barnes <[email-masked]>
Date: Fri, 2 Dec 2016 14:14:16 -0500

> I agree with this. This makes sense as a server requirement rather than

Yep, sounds good to me.  I'm going to merge #208, then handle this as a
follow-on.  Expect a PR shortly.

---

From: Richard Barnes <[email-masked]>
Date: Fri, 2 Dec 2016 14:18:33 -0500

Here you go:

https://github.com/ietf-wg-acme/acme/pull/220

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Fri, 2 Dec 2016 11:20:50 -0800

LGTM

On 12/02/2016 11:18 AM, Richard Barnes wrote:
> On Fri, Dec 2, 2016 at 2:14 PM, Richard Barnes <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>
>
>     On Fri, Dec 2, 2016 at 1:30 PM, Jacob Hoffman-Andrews
>     <[email-masked] <mailto:[email-masked]>> wrote:
>
>
>         > Richard Barnes wrote:
>     Yep, sounds good to me.  I'm going to merge #208, then handle this
>     as a follow-on.  Expect a PR shortly.
>      
>
>
>
>
> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme

---

From: Richard Barnes <[email-masked]>
Date: Fri, 2 Dec 2016 14:21:57 -0500

Thanks, merged.

On Fri, Dec 2, 2016 at 2:20 PM, Jacob Hoffman-Andrews <[email-masked]> wrote:

>> On Fri, Dec 2, 2016 at 1:30 PM, Jacob Hoffman-Andrews < <[email-masked]>
>> [email-masked]> wrote:
>>
>>>
>>> > Richard Barnes wrote:
> Acme mailing [email-masked]://www.ietf.org/mailman/listinfo/acme
>
>
>