[Forking this into two threads] [Fork 2 of 2]
On Fri, Aug 19, 2016 at 2:30 PM, Jacob Hoffman-Andrews <j...@eff.org> wrote: > On 08/19/2016 09:31 AM, Richard Barnes wrote: > > On further thought, I think I would like to propose that we go back to > > not caring about the nonce. > > There was some earlier discussion about why the nonce on the inner > payload was valuable. Could you quote that here and specifically rebut? > I think I agree with dropping it this but I want to make sure we keep > the context of the original discussion. > The original arguments were from EKR and AGWA: https://github.com/ietf-wg-acme/acme/pull/164#discussion_r72745016 EKR's comment was w.r.t. "url", which I extended to "nonce" by a general design argument. I've come around to being a bit more flexible with the inner JWS. AGWA raises the unexpected transfer risks that I mentioned up-thread. I think we're addressing those adequately with the "account" stuff we're talking about; in any case, those risks are related to identifying accounts, not to nonces. --Richard
_______________________________________________ Acme mailing list Acme@ietf.org https://www.ietf.org/mailman/listinfo/acme
