Subject: [CDNi] Response to Liaison Statement on URI Signing

From: Kevin Ma J <[email-masked]>
Date: Mon, 14 Dec 2015 20:07:41 +0000

Hi All,

  (as a chair) As per the Open Discussion action item from Yokohama [1], the chairs have worked with Ray to draft a response to the MPEG liaison statement on URI Signing [2].  Please find the response below, and feel free to send comments to the list.  If there are no objections or unaddressed comments by December 30th, we will send the official response to MPEG.

thanx!

--  Kevin J. Ma
 
[1] https://www.ietf.org/proceedings/94/minutes/minutes-94-cdni
[2] https://datatracker.ietf.org/liaison/1434/

-----

From: Kevin J. Ma
>From Group: CDNI
To: Watanabe Shinji <[email-masked]>
To Group: ISO-IEC-JTC1-SC29
Title: Response to request for information on URI Signing 2015-11-02
Response Contact: Kevin J. Ma <[email-masked]>
Technical Contact: Ray van Brandenburg <[email-masked]>
Purpose: In Response
Body:

The IETF CDNI working group would like to acknowledge our receipt of the MPEG experts liaison letter and careful consideration during the 94th IETF meeting.

Having reviewed the Online Multimedia Authorization Protocol Version 1.0 (OMAPv1) specification [2012_09_28_OATC-OMAP_1-0], we understand the proposed scope of usage for CDNI URI Signing to be the only as the Access Token, as returned by the authorization server in step (E) of sections 2.3 and 2.4 of the OMAPv1 specification, to be use solely for authorizing requests to the resource server (i.e., the CDN), as described in steps (F) and (G) of sections 2.3 and 2.4 of the OMAPv1 specification.  We agree that this is an exemplary use case for CDNI URI Signing with the Path Pattern Information Element.
 
At the 93rd IETF, the CDNI working group decided to remove text related to signing of segmented content URIs from the CDNI URI Signing draft [draft-ietf-cdni-uri-signing] in response to an IPR disclosure made after the 92nd IETF [minutes-93-cdni]. The removed sections are currently documented in a separate draft [draft-brandenburg-cdni-uri-signing-for-has], as an extension to the main URI signing document. It should be noted that at this point, that document is regarded as an independent submission and IETF has not made a decision regarding its future status. At the 94th IETF, it was agreed that the Path Pattern Information element was not covered by the IPR disclosure and would be a useful feature for a number of URI Signing use cases, including segmented content [minutes-94-cdni]. Path Pattern support will be reinstated in a future revision of the main URI signing draft.
 
With respect to long-lived tokens, as mentioned in the Security Considerations section (9) of the CDNI URI Signing draft, increasing the token validity period increases the potential for replay attacks, including DoS attacks; however, nothing in the protocol prevents the use of long-lived tokens. 

With respect to CDNs refreshing tokens, the CDNI working group discussed mechanisms for signaling token refresh between CDNs and felt that the required additional complexity of such a mechanism outweighed the cost of regenerating the tokens. Note: Signaling between CDNs and clients is out-of-scope for CDNI. As mentioned above, chained token support was removed from the current CDNI URI Signing draft and there is no plan to reinstate it in the main URI signing document due to IPR issues. As such, the topic of token regeneration is limited to [draft-brandenburg-cdni-uri-signing-for-has].

With respect to name collisions, the current version of the CDNI URI Signing draft only supports query-string-based conveyance of the token.  The metadata element "package-attribute" was introduced to allow content service providers (CSPs) to select any query string parameter name they wanted, assuming that CSPs would be in the best position to select a low-collision-probability name; URISigningPackage is only the default name.
 
With respect to consecutive tokens, the CDNI URI Signing mechanism was designed to be stateless, so that consecutive tokens can be retrieved from different delivery nodes. As such, there is no relationship between consecutive tokens and token invalidation is solely based on the Expiry Time information element.

The CDNI working group appreciates the MPEG experts' thoughtful input and looks forward to continued collaboration with MPEG experts on URI Signing.
 
Our next meeting: IETF 95, April 3-8 2016, Buenos Aires, Argentina

[2012_09_28_OATC-OMAP_1-0] http://www.oatc.us/Portals/_default/Knowledgebase/1/2012_09_28_OATC-OMAP_1-0.pdf
[draft-ietf-cdni-uri-signing] https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/
[draft-brandenburg-cdni-uri-signing-for-has] https://datatracker.ietf.org/doc/draft-brandenburg-cdni-uri-signing-for-has/
[minutes-93-cdni] https://www.ietf.org/proceedings/93/minutes/minutes-93-cdni
[minutes-94-cdni] https://www.ietf.org/proceedings/94/minutes/minutes-94-cdni

---

From: Ben Niven-Jenkins <[email-masked]>
Date: Tue, 15 Dec 2015 17:28:49 +0000

Kevin,

Looks fine to me.

Only minor comment I have: At the end of the 3rd paragraph include a reference to [draft-ietf-cdni-uri-signing] to make really clear which document is the "main URI signing draft”.

Ben

> On 14 Dec 2015, at 20:07, Kevin Ma J <[email-masked]> wrote:
> 
> Hi All,
> 
> _______________________________________________
> CDNi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cdni

---

From: Kevin Ma J <[email-masked]>
Date: Tue, 15 Dec 2015 17:32:09 +0000

Hi Ben,

  will do.

thanx!

--  Kevin J. Ma

> -----Original Message-----
> From: Ben Niven-Jenkins [mailto:[email-masked]]
> Sent: Tuesday, December 15, 2015 12:29 PM
> To: Kevin Ma J
> Cc: [email-masked]
> Subject: Re: [CDNi] Response to Liaison Statement on URI Signing
> 
> Kevin,
> 
> Looks fine to me.
> 
> Only minor comment I have: At the end of the 3rd paragraph include a
> reference to [draft-ietf-cdni-uri-signing] to make really clear which
> document is the "main URI signing draft”.
> 
> Ben
> 
> >  (as a chair) As per the Open Discussion action item from Yokohama [1],
> the chairs have worked with Ray to draft a response to the MPEG liaison
> statement on URI Signing [2].  Please find the response below, and feel
> free to send comments to the list.  If there are no objections or
> unaddressed comments by December 30th, we will send the official response
> to MPEG.
> >
> > thanx!
> >
> > --  Kevin J. Ma
> >
> > The IETF CDNI working group would like to acknowledge our receipt of the
> MPEG experts liaison letter and careful consideration during the 94th IETF
> meeting.
> >
> > Having reviewed the Online Multimedia Authorization Protocol Version 1.0
> (OMAPv1) specification [2012_09_28_OATC-OMAP_1-0], we understand the
> proposed scope of usage for CDNI URI Signing to be the only as the Access
> Token, as returned by the authorization server in step (E) of sections 2.3
> and 2.4 of the OMAPv1 specification, to be use solely for authorizing
> requests to the resource server (i.e., the CDN), as described in steps (F)
> and (G) of sections 2.3 and 2.4 of the OMAPv1 specification.  We agree
> that this is an exemplary use case for CDNI URI Signing with the Path
> Pattern Information Element.
> >
> > At the 93rd IETF, the CDNI working group decided to remove text related
> to signing of segmented content URIs from the CDNI URI Signing draft
> [draft-ietf-cdni-uri-signing] in response to an IPR disclosure made after
> the 92nd IETF [minutes-93-cdni]. The removed sections are currently
> documented in a separate draft [draft-brandenburg-cdni-uri-signing-for-
> has], as an extension to the main URI signing document. It should be noted
> that at this point, that document is regarded as an independent submission
> and IETF has not made a decision regarding its future status. At the 94th
> IETF, it was agreed that the Path Pattern Information element was not
> covered by the IPR disclosure and would be a useful feature for a number
> of URI Signing use cases, including segmented content [minutes-94-cdni].
> Path Pattern support will be reinstated in a future revision of the main
> URI signing draft.
> >
> > With respect to long-lived tokens, as mentioned in the Security
> Considerations section (9) of the CDNI URI Signing draft, increasing the
> token validity period increases the potential for replay attacks,
> including DoS attacks; however, nothing in the protocol prevents the use
> of long-lived tokens.
> >
> > With respect to CDNs refreshing tokens, the CDNI working group discussed
> mechanisms for signaling token refresh between CDNs and felt that the
> required additional complexity of such a mechanism outweighed the cost of
> regenerating the tokens. Note: Signaling between CDNs and clients is out-
> of-scope for CDNI. As mentioned above, chained token support was removed
> from the current CDNI URI Signing draft and there is no plan to reinstate
> it in the main URI signing document due to IPR issues. As such, the topic
> of token regeneration is limited to [draft-brandenburg-cdni-uri-signing-
> for-has].
> >
> > With respect to name collisions, the current version of the CDNI URI
> Signing draft only supports query-string-based conveyance of the token.
> The metadata element "package-attribute" was introduced to allow content
> service providers (CSPs) to select any query string parameter name they
> wanted, assuming that CSPs would be in the best position to select a low-
> collision-probability name; URISigningPackage is only the default name.
> >
> > With respect to consecutive tokens, the CDNI URI Signing mechanism was
> designed to be stateless, so that consecutive tokens can be retrieved from
> different delivery nodes. As such, there is no relationship between
> consecutive tokens and token invalidation is solely based on the Expiry
> Time information element.
> >
> > The CDNI working group appreciates the MPEG experts' thoughtful input
> and looks forward to continued collaboration with MPEG experts on URI
> Signing.
> >
> > [2012_09_28_OATC-OMAP_1-0]
> http://www.oatc.us/Portals/_default/Knowledgebase/1/2012_09_28_OATC-
> OMAP_1-0.pdf
> > [draft-brandenburg-cdni-uri-signing-for-has]
> https://datatracker.ietf.org/doc/draft-brandenburg-cdni-uri-signing-for-
> has/

---

From: Kevin Ma J <[email-masked]>
Date: Tue, 15 Dec 2015 17:49:21 +0000

I cleaned up the draft language
- removed "main" or changed "main" -> "CDNI" in all places
- used "extension" to refer to Ray's draft
- changed "document" -> "draft" in all places
- added references to [draft-ietf-cdni-uri-signing] after all mentions of the draft

From: Kevin J. Ma
From Group: CDNI

 
At the 93rd IETF, the CDNI working group decided to remove text related to signing of segmented content URIs from the CDNI URI Signing draft [draft-ietf-cdni-uri-signing] in response to an IPR disclosure made after the 92nd IETF [minutes-93-cdni]. The removed sections are currently documented in a separate draft [draft-brandenburg-cdni-uri-signing-for-has], as an extension to the CDNI URI signing draft [draft-ietf-cdni-uri-signing]. It should be noted that at this point, that document is regarded as an independent submission and IETF has not made a decision regarding its future status. At the 94th IETF, it was agreed that the Path Pattern Information element was not covered by the IPR disclosure and would be a useful feature for a number of URI Signing use cases, including segmented content [minutes-94-cdni]. Path Pattern support will be reinstated in a future revision of the CDNI URI signing draft [draft-ietf-cdni-uri-signing].

With respect to CDNs refreshing tokens, the CDNI working group discussed mechanisms for signaling token refresh between CDNs and felt that the required additional complexity of such a mechanism outweighed the cost of regenerating the tokens. Note: Signaling between CDNs and clients is out-of-scope for CDNI. As mentioned above, chained token support was removed from the CDNI URI Signing draft [draft-ietf-cdni-uri-signing] and there is no plan to reinstate it in the CDNI URI signing draft [draft-ietf-cdni-uri-signing] due to IPR issues. As such, the topic of token regeneration is limited to the extension draft [draft-brandenburg-cdni-uri-signing-for-has].

With respect to name collisions, the current version of the CDNI URI Signing draft [draft-ietf-cdni-uri-signing] only supports query-string-based conveyance of the token.  The metadata element "package-attribute" was introduced to allow content service providers (CSPs) to select any query string parameter name they wanted, assuming that CSPs would be in the best position to select a low-collision-probability name; URISigningPackage is only the default name.

 

> From: Kevin Ma J
> Sent: Tuesday, December 15, 2015 12:33 PM
> To: 'Ben Niven-Jenkins'
> Cc: [email-masked]
> Subject: RE: [CDNi] Response to Liaison Statement on URI Signing
> 
> Hi Ben,
> 
>   will do.
> 
> thanx!
> 
> --  Kevin J. Ma
>

---

From: Kevin Ma J <[email-masked]>
Date: Wed, 30 Dec 2015 15:51:32 +0000

Hi All,

  Having heard no other objections or comments, the chairs will move ahead with filing the liaison response.

thanx!

--  Kevin J. Ma

> Sent: Tuesday, December 15, 2015 12:50 PM
> To: 'Ben Niven-Jenkins'
> Cc: [email-masked]'
> At the 93rd IETF, the CDNI working group decided to remove text related to
> signing of segmented content URIs from the CDNI URI Signing draft [draft-
> ietf-cdni-uri-signing] in response to an IPR disclosure made after the
> 92nd IETF [minutes-93-cdni]. The removed sections are currently documented
> in a separate draft [draft-brandenburg-cdni-uri-signing-for-has], as an
> extension to the CDNI URI signing draft [draft-ietf-cdni-uri-signing]. It
> should be noted that at this point, that document is regarded as an
> independent submission and IETF has not made a decision regarding its
> future status. At the 94th IETF, it was agreed that the Path Pattern
> Information element was not covered by the IPR disclosure and would be a
> useful feature for a number of URI Signing use cases, including segmented
> content [minutes-94-cdni]. Path Pattern support will be reinstated in a
> future revision of the CDNI URI signing draft [draft-ietf-cdni-uri-
> signing].
> 
> from the CDNI URI Signing draft [draft-ietf-cdni-uri-signing] and there is
> no plan to reinstate it in the CDNI URI signing draft [draft-ietf-cdni-
> uri-signing] due to IPR issues. As such, the topic of token regeneration
> is limited to the extension draft [draft-brandenburg-cdni-uri-signing-for-
> has].
> 
> Signing draft [draft-ietf-cdni-uri-signing] only supports query-string-
> based conveyance of the token.  The metadata element "package-attribute"
> was introduced to allow content service providers (CSPs) to select any
> query string parameter name they wanted, assuming that CSPs would be in
> the best position to select a low-collision-probability name;
> URISigningPackage is only the default name.
> 
> The CDNI working group appreciates the MPEG experts' thoughtful input and
> looks forward to continued collaboration with MPEG experts on URI Signing.
> 
> > > > [draft-ietf-cdni-uri-signing]
> https://datatracker.ietf.org/doc/draft-
> > > ietf-cdni-uri-signing/
> > > > [minutes-93-cdni]
> https://www.ietf.org/proceedings/93/minutes/minutes-
> > > 93-cdni
> > > > [minutes-94-cdni]
> https://www.ietf.org/proceedings/94/minutes/minutes-
> > > 94-cdni
> > > >
> > > >
> > > >