Subject: Remaining lifetime | Re: draft-ietf-httpbis-http2-encryption-06.txt

From: Kari Hurtta <[email-masked]>
Date: Mon, 4 Jul 2016 19:04:38 +0300 (EEST)

Kari Hurtta <[email-masked]>: (Wed Jun 22 19:36:14 2016)
> Opportunistic Security for HTTP
> https://tools.ietf.org/html/draft-ietf-httpbis-http2-encryption-06
> 
> 
> https://tools.ietf.org/html/draft-ietf-httpbis-http2-encryption-06#section-5.1
> 
> |   When the value of the "tls-commit" member is "true" ([RFC7159],
> |   Section 3), it indicates that the origin makes such a commitment for
> |   the duration of the origin object lifetime.
> 
> |   Including "tls-commit" creates a commitment to provide a secured
> |   alternative service for the advertised period.  Clients that receive
> |   this commitment can assume that a secured alternative service will be
> |   available for the origin object lifetime.  Clients might however
> |   choose to limit this time (see Section 5.3).
> 
> https://tools.ietf.org/html/draft-ietf-httpbis-http2-encryption-06#section-6
> 
> |   o  The origin object has a "lifetime" member, whose value is a number
> |      indicating the number of seconds which the origin object is valid
> |      for (hereafter, the "origin object lifetime"), and
> |
> |   o  The origin object lifetime is greater than the "current_age" (as
> |      per [RFC7234], Section 4.2.3).
> 
> I think that this does not say when origin's object lifitime starts.
> This seems imply that object lifetime start from that point what "current_age"
> calculation uses but that is not required.
> 
> Therefore I guess that remaining lifetime (and possible remaining commitment)
> 
>    = lifetime - "current_age"
> 
> 
> But seem that remaining commintment time
>     = value of "lifitime"
> 
> is also possible reading.  This does not look dangerous.

Perhaps add to somewhere:

  Remaining lifetime of origin object is origin object lifetime
  subtracted "current_age" of response. This is also remaining
  duration for opportunistic commitment ("tls-commit").

Or something like that ?

/ Kari Hurtta

---

From: Kari hurtta <[email-masked]>
Date: Mon, 4 Jul 2016 19:34:42 +0300 (EEST)

6.  The "http-opportunistic" well-known URI

Should there somewhere have mentioned:

  "http-opportunistic" well-known URI alone does not establishment
  alternative service for listed origins. Also origin must provide
  an alternative service advertisement [RFC7838].

That is:

  Do not use some service for given origin even 
  when /.well-known/http-opportunistic from that service 
  lists origin if origin does not advertise that alternative 
  service.

/ Kari Hurtta

---

From: Martin Thomson <[email-masked]>
Date: Mon, 11 Jul 2016 15:45:17 +1000

>   duration for opportunistic commitment ("tls-commit").

I had a look at this, and couldn't really see that it was necessary.
The origin object is defined as being valid if the lifetime is greater
than the current age.

The best I could come up with is this:

 A client SHOULD avoid sending requests via cleartext protocols or to
unauthenticated alternative
-services for the duration of the origin object lifetime, except to
discover new potential
-alternatives.
+services while the origin object lifetime remains valid (see
{{well-known}}), except to discover
+new potential alternatives.

But I'm not convinced that we need it.

---

From: Kari Hurtta <[email-masked]>
Date: Mon, 11 Jul 2016 19:49:31 +0300 (EEST)

Martin Thomson <[email-masked]>: (Mon Jul 11 08:45:17 2016)
> But I'm not convinced that we need it.

Seems that my original comment was  lost:

------------------------------------------------------------
https://tools.ietf.org/html/draft-ietf-httpbis-http2-encryption-06#section-6

is also possible reading.  This does not look dangerous.
------------------------------------------------------------

https://tools.ietf.org/html/draft-ietf-httpbis-http2-encryption-05
tehre was:

| commitment interval starts when the commitment is received and
| authenticated and runs for a number of seconds equal to value of the
| "tls-commit" member, less the current age of the http-opportunistic
| response 

Seems that currently that "less the current age of the http-opportunistic
response" is not explicty mentioned. Or perhaps I missed something?

/ Kari Hurtta