Having never heard of this proposal before, I found the concept
interesting, but the exposition in the draft was difficult to grasp in
certain places. I believe that it is because the text assumes that
the reader already knows the underlying theory of what the process is
intended to accomplish.
For example, in section 3, the syntax of the "ni" URI scheme is
spelled out with admirable clarity and exactness, including:
Digest Value [Required] The digest value MUST be encoded using the
base64url [RFC4648] encoding.
Hmmm, "the digest value"... The digest value *of what*?
Considering the previous section 2, it seems that there is some
implicit string, which when hashed by the algorithm specified in the
"Digest Algorithm" part, produces the "Digest Value". And given the
discussion, it seems that this string is an *input* to the process of
generating an ni URI, and that the ni URI is really a way of encoding
this string. The string itself is specified by some external reality,
and seems to be expected to represent or specify some object in some
way, and thus the ni URI is a "name" for that object.
So far, so good, although it would have been better if this was
spelled out explicitly.
Going back to section 2 for a moment, there is:
When the input to the hash algorithm is a public key value, as may be
used by various security protocols, the hash SHOULD be calculated
over the public key in an X.509 SubjectPublicKeyInfo structure
(Section 4.1 of [RFC5280]).
I can see what this means, but it's not very clear. A better way to
write it would be:
When the input is intended to be a public key value, as may be
used by various security protocols, the input to the hash SHOULD
be an X.509 SubjectPublicKeyInfo structure (Section 4.1 of
[RFC5280]) containing the public key rather than the public key
value itself.
In section 8 is:
The following ni URI references the text "Hello World!" (without the
quotes, being 12 characters), [...]
But the term "references" seems not to have been used in this sense
before in the draft. More clear would be:
The following ni URI is generated from the string "Hello World!"
(without the quotes, being 12 characters), [...]
Unfortunately, the example is somewhat incongruous, as "Hello World!"
is not obviously a name or reference to any object. Thus while it
still is clear how it can be input to the processes that are described
in the draft, it doesn't seem to be a conceptually typical example.
Then we get to:
Given the SubjectPublicKeyInfo in Figure 6 we derive the names shown
in Figure 7 for this value.
I can't tell what this means. What is "this value"? Is it the
immediately preceding URI
(http://example.com/.well-known/ni/sha-256/f4OxZX_x_FO5LcGBSKHWXfwtSx-j1ncoSt3SABJtkGk)?
In what manner does the "given" SubjectPublicKeyInfo affect the names?
If the input value was meant to be the SubjectPublicKeyInfo itself,
the sentence would not add "this value", which strongly suggests a
*different* value than the one mentioned just before in the same
sentence. Rather, one would say:
We derive the names shown in Figure 7 from the SubjectPublicKeyInfo
in Figure 6.
Dale
