Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add security consideration around Multiformat choice. #107

Merged
merged 2 commits into from
Oct 19, 2024
Merged

Add security consideration around Multiformat choice. #107

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7394ba2
Add security consideration around Multiformat choice.
msporny Oct 13, 2024
9a4fe3b
Fix grammar and flow in Multiformat choice section
msporny Oct 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2878,6 +2878,39 @@ <h3>Revocation Semantics</h3>
</section>
</section>

<section>
<h2>Choosing a Multiformat</h2>

<p>
<dfn class="external lint-ignore">Multiformats</dfn> enable self-describing
data; if data is known to be a Multiformat, its exact type can be determined by
reading a few compact header bytes that are expressed at the beginning of the
data. <a href="#multibase-0">Multibase</a>, <a href="#multihash">Multihash</a>,
and <a href="#Multikey">Multikey</a> are types of Multiformats that are defined
by this specification.
</p>

<p>
Some mistakenly presume that Multiformats promote an explosion of encoding
formats, which harm interoperability due to forcing implementers to have to
implement many different formats. To the contrary, Multiformats exist because
Copy link
Member

@iherman iherman Oct 14, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Some mistakenly presume that Multiformats promote an explosion of encoding
formats, which harm interoperability due to forcing implementers to have to
implement many different formats. To the contrary, Multiformats exist because
Multiformats exist because

I do not think it is worth and necessary to get into this kind of polemics here. I would prefer to just describe why we have this formats here and leave the discussions aside. The change above may be the simplest change; you may choose to reformulate the paragraph as a whole...

there are multiple choices in the world today when it comes to things like base
encoding functions, cryptographic hashing functions, and cryptographic key
formats. The creation and use of Multiformats acknowledge that application
developers make different choices based upon different requirements. Imposing a
single base-encoding, cryptographic hashing, or cryptographic key format on the
world has never worked. Instead, Multiformats provide a mechanism to detect any
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
developers make different choices based upon different requirements. Imposing a
single base-encoding, cryptographic hashing, or cryptographic key format on the
world has never worked. Instead, Multiformats provide a mechanism to detect any
developers make different choices based upon different requirements, and no single standards
could emerge for base-encoding, cryptographic hashing, or for cryptographic key formats. Multiformats provide a mechanism to detect any

(Additional change related to my previous comment.)

base encoding, cryptographic hash, or cryptographic key format.
msporny marked this conversation as resolved.
Show resolved Hide resolved
</p>

<p>
When possible, specification authors are urged to, ideally, pick a single
Multiformat and, if that is not possible, minimize the number of Multiformats
any particular application or ecosystem uses to increase interoperability.
msporny marked this conversation as resolved.
Show resolved Hide resolved
</p>

</section>

<section>
<h2>Encrypted Data in Controller Documents</h2>
<p>
Expand Down