Subject: [CDNi] URI Signing Shared Key Question

From: Phil Sorber <[email-masked]>
Date: Tue, 9 Nov 2021 15:39:20 -0700

This is one of three questions that I had after last call feedback. I'd
like to hear any opinions on the matter from the working group. I will be
pointing to this thread for explanation/justification about the changes or
lack thereof to the document. Thanks.

Do we want to remove text about Shared Key support in favor of a smaller
comment about how it's possible to do for an internal use case, but not
condoned or recommended by the document, or do we want to keep it as is and
cite having niche value and make sure we have strong language about the
dangers of using it?

---

From: Kevin Ma <[email-masked]>
Date: Wed, 10 Nov 2021 12:54:18 -0500

Hi All,

  (As an individual) When we first started the draft, all the vendors were
using shared keys, so it was natural to have that as a feature to ease
migration and improve adoption.  It looks like shared keys are still used
in other URI signing schemes today, so I can only assume it is still a
desirable feature, even if it is not secure (along with the other known
caveats about the security of URI signing in general).  I could go either
way on this one.  We're not preventing anyone from using shared keys, but
we may reduce adoption if it is not readily apparent how to use them.  It's
a similar argument to the client IP question: are users better off with URI
signing with a shared key than some other proprietary protocol (not vetted
by secdir) that more readily fits their use case?  I would lean toward
stronger language about it being not recommended.

thanx!

--  Kevin J. Ma

On Tue, Nov 9, 2021 at 5:39 PM Phil Sorber <[email-masked]> wrote:

> _______________________________________________
> CDNi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cdni
>