Subject: Re: [httpwg/http-extensions] Reuse of Exported Authenticator Context fields (#468)

From: HTTP issue updates <[email-masked]>
Date: Mon, 09 Apr 2018 13:07:26 -0700

Closed #468.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/468#event-1564683166

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 09 Apr 2018 20:07:26 +0000 (UTC)

This seems to be OBE.  The certificate_request_context in the current draft (stated in #481) is `the two-octet Request-ID as well as at least 96 bits of additional entropy.`  This seems sufficiently unpredictable, and the Request-ID is required to be unique, so even if it's a counter the combination should be both unique and unpredictable.

Cert-ID doesn't appear to be passed to the Exported Authenticator API at all, so that's a moot point.

@grittygrease, @martinthomson, please re-open if you think there's more required to meet these requirements.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/468#issuecomment-379877571