Add security consideration around Multiformat choice.

[msporny]

This PR is an attempt to partially address issue #94 by adding a security consideration around Multiformat choice.

/cc @jyasskin and @hadleybeeman

---

Preview | Diff

[iherman]

Suggested change

	Some mistakenly presume that Multiformats promote an explosion of encoding
	formats, which harm interoperability due to forcing implementers to have to
	implement many different formats. To the contrary, Multiformats exist because
	Multiformats exist because

I do not think it is worth and necessary to get into this kind of polemics here. I would prefer to just describe why we have this formats here and leave the discussions aside. The change above may be the simplest change; you may choose to reformulate the paragraph as a whole...

[iherman]

Suggested change

	developers make different choices based upon different requirements. Imposing a
	single base-encoding, cryptographic hashing, or cryptographic key format on the
	world has never worked. Instead, Multiformats provide a mechanism to detect any
	developers make different choices based upon different requirements, and no single standards
	could emerge for base-encoding, cryptographic hashing, or for cryptographic key formats. Multiformats provide a mechanism to detect any

(Additional change related to my previous comment.)

[iherman]

The issue was discussed in a meeting on 2024-10-16

• no resolutions were taken

View the transcript

4.3. Add security consideration around Multiformat choice. (pr controller-document#107)

See github pull request controller-document#107.

Manu Sporny: TAG also asked for Security Considerations for multi format choice.
… cannot tell difference between base64 and base32 encodings but with multi-encoding you can.
… but we have not done this is the relatedResource property.

David Chadwick: the way I read this, in order to determine whether its b64, you have to read the spec. in multi-encoding you don't have the issue (have a prefix that tells you what it is); however, you have to go to the spec to understand this too.

Manu Sporny: multibase encoding has a multibase type so can take the text and you know that the first character will tell you the encoding format.

Dave Longley: +1 you define the multibase type once, and you can then reuse it across software and specs and if you need to switch anything, the impact can be reduced.

[msporny]

Editorial, multiple reviews, changes requested and made, no objections, merging.