Subject: Policy URL -> Policy URI

From: Rick van Rein <[email-masked]>
Date: Mon, 07 Feb 2005 11:50:21 +0100

Hello OpenPGP-drafters,

It seems important to me to consider replacing URL with URI in the OpenPGP
spec.  This would include URN-schemes, such as references to books that
everybody can pick up in their local bookstore or at Amazon.  A book URN       
would look like URN:ISBN:1-234-56789-0 (see RFC 3187).  There are several       
other useful URN schema's.

There are two places in the specification that speak of URL's; one is the       
keyserver (which really is a location, so it makes sense to keep it as
a URL) and the other is the policy.  I think it makes sense to support more
than just the available-on-my-website kind of local/incompatible policies.

Note that other signing standards do speak of URIs for policies.  In the
PKIX standard RFC 3280, there is a CPSuri definiton; in RFC 3275 (XML
Signing) there is no explicit support for policies (...) but the proper way
of getting it into the signature is with a <Reference/> element which
obtains its information from a URI rather than just a URL.

In OpenPGP, replacing a Policy URL with a Policy URI need not lead to    
conflicts with older software; inasfar as they interpret the subpacket,
they usually treat it either as a literal string that should be matched or
as something that can be presented in a browser.  The reason is that
policies cannot be interpreted by software -- they are usually written in
English.

Browsers are supposed to resolve URN-schemes; as far as they do not
recognise them they will consider the urn: start as a protocol, and of
course state that they do not support it.  Same goes for any other
downloading software.

In other words, the change of a Policy URL into a Policy URN seems
advantageous, and I cannot see how it could cause problems.  I therefore
warmly recommend changing it.

Thanks,

Rick van Rein,
OpenFortress Digital signatures

---

From: Jon Callas <[email-masked]>
Date: Mon, 7 Feb 2005 16:50:29 -0800

Okay, I see what you're saying, but is it necessary?

A long time ago, the keyserver URL said URI and we changed it for 
reasons that I can't remember. I think it's because we didn't think it 
was necessary, that if it happened to be a URI, the worst that could 
happen would be that someone wouldn't understand it, but that's always 
a risk.

If you happened to put in the policy URL an ISBN number, wouldn't it be 
obvious what it meant? Wouldn't it work just fine?

I don't mind changing it, but is this just a difference without 
distinction?

	Jon

---

From: Rick van Rein <[email-masked]>
Date: Tue, 08 Feb 2005 10:24:10 +0100

Hello Jon, others,

> Okay, I see what you're saying, but is it necessary?

I think it is.

1. I think PGP is providing too little certainty about the meaning of a
   signature with its current four-grade signing setup.  At least, it is
   not suitable for commercial use, which would be great to support.  A
   suitable policy mechanism can help in that case.

2. It is not smart to fall behind on other signing flexibility; PGP already
   lacks the appeal to decision-makers that PKIX and even XML Signing have;
   any URN-based policy initiative could therefore easily forget to
   incorporate PGP and render it useless for that kind of application.

3. There are always work-arounds.  For example, the kind of schemes
   suggested under 2. could declare a website to do the translation from
   URN to URL for the sake of PGP.  Aside from that being awkward, it would
   be a challenge to the longevity of the spec and may for that reason be
   left out.  We don't want that to happen.

> happen would be that someone wouldn't understand it, but that's always 

Indeed, the *keyserver* should not be referenced by name -- if you cannot
determine the location of a server what is it going to be good for?

For policies, I think we have a whole different matter at hand --
references to books, an ISSN-series of widely acknowledged signing policies
and ASN.1 OIDs are all good ways to point at a policy.  Moreover, they are
supportive of Internet-wide schemes, which is rarely the case if a URL is
used.

Imagine that I would start pushing PGP-signers to follow
	http://openfortress.nl/doc/some-policy.pdf
How would that make you feel?  It would mean some company set it up.  A
company with full control over the URL.  Other companies are going to be
too proud or too smart to use the same signing policy *location*.  Even if
they literally copy the content, the average signature validator would not
notice because the strings differ.  In short, URLs are bad for
interoperable policies.

A URN-scheme on the other hand, can serve quite well for Internet-wide,
non-proprietary published policies.  It can enforce the secure hash of a
document, which can only be weakly suggested in a URL.  That would take
care of the pride issue.  Furthermore, URNs can support rewriting to
equivalent forms, which would be helpful for supportive software to find
more matches than a simple string match can be.

> obvious what it meant? Wouldn't it work just fine?

There are always work-arounds, but why invite them?  There are no
disadvantages to changing to a Policy URI.

> I don't mind changing it, but is this just a difference without 

The change is vital in my opinion.

Thanks,
 -Rick

---

From: Rick van Rein <[email-masked]>
Date: Tue, 08 Feb 2005 10:41:29 +0100

Jon,

> obvious what it meant? Wouldn't it work just fine?

You are suggesting to keep the standard as is and to let those who find it
constraining simply make their own standard, right?

I don't think that's a good idea :) especially because a suitable and
globally accepted mechanism exists -> the URN, part of the URI scheme.

Rick van Rein,
OpenFortress.

---

From: Florian Weimer <[email-masked]>
Date: Tue, 08 Feb 2005 11:14:06 +0100

* Jon Callas:

> reasons that I can't remember.

Back then, the URI *identified* a resource, but this doesn't make much
sense in the OpenPGP context (were fingerprints are used to identify
keys).  The keyserver location is just that, a location.

The URI terminology has changed since then.

---

From: David Shaw <[email-masked]>
Date: Tue, 8 Feb 2005 13:32:33 -0500

> The URI terminology has changed since then.

If URI doesn't mean what it used to, does it then make sense to change
both the keyserver and policy URLs to URIs?

David

---

From: Rick van Rein <[email-masked]>
Date: Tue, 08 Feb 2005 22:34:45 +0100

Florian,

> both the keyserver and policy URLs to URIs?

Yes, please specify.  We don't want this to end up in a sort of FUD against
URIs.  To the best of my knowledge, it's all really simple, as summarised
here:

http://rick.vanrein.org/blog/notes/urn-uri-url.2005-02-07-13-53.article

Best,
-Rick

---

From: Florian Weimer <[email-masked]>
Date: Wed, 09 Feb 2005 00:15:38 +0100

> http://rick.vanrein.org/blog/notes/urn-uri-url.2005-02-07-13-53.article

Ahem, STD 66 presents a slightly different view. 8-)

The problem is that it's impossible to distinguish identifiers and
locators at the syntax level.  It's not possible to uphold the URN/URL
distinction.

---

From: David Shaw <[email-masked]>
Date: Tue, 8 Feb 2005 22:39:14 -0500

> locators at the syntax level.  It's not possible to uphold the URN/URL

After giving reading STD 66 a quick once over (and it is indeed new -
less than a month old), I see your point.  Especially since there is
no way to tell them apart anyway, I think that the proper thing for
2440bis is to call *both* keyserver and policy URLs, URIs instead.

There are a number of reasons, but the main one as I see it is that it
is not our business (as OpenPGP people) to tell people what is
acceptable for their keyserver or policy fields to point to.  If
someone wants to point to a book, great.  Go ahead.  If some
implementation wants to support URNs, also great.

Making this change has no impact on any implementations since URLs are
URIs.

David

---

From: Rick van Rein <[email-masked]>
Date: Wed, 09 Feb 2005 11:18:09 +0100

The standards speak!

The very recent STD 66 annex RFC 3986 states, in 1.1.3:

   An individual scheme does not have to be classified as being just one
   of "name" or "locator".  Instances of URIs from any given scheme may
   have the characteristics of names or locators or both, often
   depending on the persistence and care in the assignment of
   identifiers by the naming authority, rather than on any quality of
   the scheme.  Future specifications and related documentation should
   use the general term "URI" rather than the more restrictive terms
   "URL" and "URN" [RFC3305].

So...
 - my side-claim that a URI is either a URL or a URN is not true anymore
 - my suggestion to change Policy URL to Policy URI is a must-do
 - changing Keyserver URL to Keyserver URI comes highly recommended as well

Let's just do it as the standard states, change every URL to a URI.

Cheers,
 -Rick