Subject: [Unbearable] Where does the proof of possession belong?

From: Martin Thomson <[email-masked]>
Date: Mon, 16 Feb 2015 23:00:49 +1100

It's fairly clear that the first target of this is HTTP cookies, but
the TLS extension is clearly written with higher aspirations than just
one meagre protocol, as is the charter. What other protocols is this
intended to address?

I ask for several reasons:

I don't see anything in the current charter using the TLS
modifications.  The HTTP usage lifts the format and hosts almost all
of the binding protocol [1].  That leads me to wonder if other uses of
the basic protocol can't do the same.

I am also highly skeptical of frameworks.  Understanding the
properties of something in the abstract is very valuable, as is
applying the lessons learned in one context to another.  It's very
different to attempt to codify that abstraction into a framework,
which is an expensive process and can result in poor application where
the original design didn't consider the new host.

[1] Signature algorithm negotiation is problematic in the HTTP solution anyway.

---

From: Andrei Popov <[email-masked]>
Date: Mon, 16 Feb 2015 23:56:36 +0000

> It's fairly clear that the first target of this is HTTP cookies, but the TLS extension is clearly written with higher aspirations than just one meagre protocol, as is the charter. 

Please clarify: what TLS extension are you referring to?

> I am also highly skeptical of frameworks.  Understanding the properties of something in the abstract is very valuable, as is applying the lessons learned in one context to another.  It's very different to attempt to codify that abstraction into a framework, which is an expensive process and can result in poor application where the original design didn't consider the new host.

I would also prefer the approach of applying the lessons learned in one context to another, rather than codifying abstractions into frameworks:)
 
Cheers,

Andrei

-----Original Message-----
From: Unbearable [mailto:[email-masked]] On Behalf Of Martin Thomson
Sent: Monday, February 16, 2015 4:01 AM
To: [email-masked]
Subject: [Unbearable] Where does the proof of possession belong?

It's fairly clear that the first target of this is HTTP cookies, but the TLS extension is clearly written with higher aspirations than just one meagre protocol, as is the charter. What other protocols is this intended to address?

I don't see anything in the current charter using the TLS modifications.  The HTTP usage lifts the format and hosts almost all of the binding protocol [1].  That leads me to wonder if other uses of the basic protocol can't do the same.

I am also highly skeptical of frameworks.  Understanding the properties of something in the abstract is very valuable, as is applying the lessons learned in one context to another.  It's very different to attempt to codify that abstraction into a framework, which is an expensive process and can result in poor application where the original design didn't consider the new host.

_______________________________________________
Unbearable mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/unbearable