<html><body bgcolor="#FFFFFF"><div><br></div><div><br>On 2010/04/29, at 0:48, John Bradley <<a href="mailto:jbradley@mac.com">jbradley@mac.com</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div>Is the randomness requirement different for the request? I think that we can safely assume that the request can be public.</div></blockquote><div><br></div>I am not so sure about it. For a static request, it is safe to assume that it is a public request. However, for a dynamic request, there are chances that's request contains personalized data, which may be revealed at the OP. <div><br></div><div>Under such circumstances, it may be wise to use a randomized reference to the request, IMHO. </div><div><br><blockquote type="cite"><div> <div><br></div><div>The only randomness requirement would be to prevent an attacker from guessing it. I think it would be better to only assume it is a reference to the request and may be used across multiple requests.</div><div><br></div><div>Why do you think there is a randomness requirement?</div><div><br></div><div>John B.</div><div><br></div><div><br><div><div>On 2010-04-28, at 10:32 AM, Nat wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div bgcolor="#FFFFFF"><div>John, </div><div><br></div><div>I am open to call request artifact as something else, but I do not think it is a good idea to combine the request artifact and <span class="Apple-style-span" style="font-size: 15px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); ">rpfurl as the randomness requirement is very different. </span><br><br>=nat @ Tokyo via iPhone</div><div><br>On 2010/04/28, at 23:25, John Bradley <<a href="mailto:jbradley@mac.com"><a href="mailto:jbradley@mac.com">jbradley@mac.com</a></a>> wrote:<br><br></div><div></div><blockquote type="cite"><div><span>Nat,</span><br><span></span><br><span>One simplification to consider for 7.6 may be to combine artifact and rpfurl.</span><br><span></span><br><span>If the OP has returned artifact that could be:</span><br><span>Some internal refrence ID.</span><br><span>A URL pointing to some internal reference.</span><br><span>Some compressed version of the request.</span><br><span></span><br><span>If we think of the value as a reference to the request then the rpfurl is also a reference to the request.</span><br><span></span><br><span>The only difference is that one is defined by the OP and the other by the RP.</span><br><span></span><br><span>It may be confusing for people to have two things called artifact one for the request and one for the response.</span><br><span></span><br><span>The request could be renamed to something like request_refrence </span><br><span></span><br><span>Some people may prefer them separate to make validation easier.</span><br><span></span><br><span>It is not a big thing.</span><br><span></span><br><span>John B.</span></div></blockquote></div></blockquote></div><br></div></div></blockquote></div></body></html>