Hi Dale, On 06/12/2012 03:04 PM, Worley, Dale R (Dale) wrote: > Having never heard of this proposal before, I found the concept > interesting, but the exposition in the draft was difficult to grasp in > certain places. I believe that it is because the text assumes that > the reader already knows the underlying theory of what the process is > intended to accomplish.
I'm not sure there's a theory:-) > For example, in section 3, the syntax of the "ni" URI scheme is > spelled out with admirable clarity and exactness, including: > > Digest Value [Required] The digest value MUST be encoded using the > base64url [RFC4648] encoding. > > Hmmm, "the digest value"... The digest value *of what*? The input to the digest is not defined by this draft, except in the case of public keys. (See other comments wrt MIME & Content Type as well.) "Other than in the above special case where public keys are used, we do not specify the hash function input here. Other specifications are expected to define this." > Considering the previous section 2, it seems that there is some > implicit string, which when hashed by the algorithm specified in the > "Digest Algorithm" part, produces the "Digest Value". And given the > discussion, it seems that this string is an *input* to the process of > generating an ni URI, and that the ni URI is really a way of encoding > this string. The string itself is specified by some external reality, > and seems to be expected to represent or specify some object in some > way, and thus the ni URI is a "name" for that object. > > So far, so good, although it would have been better if this was > spelled out explicitly. > > Going back to section 2 for a moment, there is: > > When the input to the hash algorithm is a public key value, as may be > used by various security protocols, the hash SHOULD be calculated > over the public key in an X.509 SubjectPublicKeyInfo structure > (Section 4.1 of [RFC5280]). > > I can see what this means, but it's not very clear. A better way to > write it would be: > > When the input is intended to be a public key value, as may be > used by various security protocols, the input to the hash SHOULD > be an X.509 SubjectPublicKeyInfo structure (Section 4.1 of > [RFC5280]) containing the public key rather than the public key > value itself. Have to say I prefer the existing text. > > In section 8 is: > > The following ni URI references the text "Hello World!" (without the > quotes, being 12 characters), [...] > > But the term "references" seems not to have been used in this sense > before in the draft. More clear would be: > > The following ni URI is generated from the string "Hello World!" > (without the quotes, being 12 characters), [...] Ack. Thanks. > > Unfortunately, the example is somewhat incongruous, as "Hello World!" > is not obviously a name or reference to any object. In this case the object named is just those 12 characters. > Thus while it > still is clear how it can be input to the processes that are described > in the draft, it doesn't seem to be a conceptually typical example. Well, I could have said a file that contains "Hello World!" (12 chars:-) But I don't think its much clearer, maybe less. > Then we get to: > > Given the SubjectPublicKeyInfo in Figure 6 we derive the names shown > in Figure 7 for this value. > > I can't tell what this means. What is "this value"? Is it the > immediately preceding URI > (http://example.com/.well-known/ni/sha-256/f4OxZX_x_FO5LcGBSKHWXfwtSx-j1ncoSt3SABJtkGk)? > In what manner does the "given" SubjectPublicKeyInfo affect the names? No, the input value is the DER encoding of the SPKI as stated earlier. I guess the following is a little more correct so I've changed it to: Given the DER-encoded SubjectPublicKeyInfo in Figure 6 we derive the names shown in Figure 7 for this value. > If the input value was meant to be the SubjectPublicKeyInfo itself, > the sentence would not add "this value", which strongly suggests a > *different* value than the one mentioned just before in the same > sentence. Rather, one would say: > > We derive the names shown in Figure 7 from the SubjectPublicKeyInfo > in Figure 6. I don't get the difference to be honest. Cheers, S. > > Dale > >
