<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>RE: [PROPOSAL] request nonce and name</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>I don't inherently see a problem with this, though it can't be required since relying parties may not be able to keep state.<BR>
<BR>
I'd vote for openid.request_nonce and openid.response_nonce just in making it clear what they actually are. I'm fine linking people off to WikiPedia (<A HREF="http://en.wikipedia.org/wiki/Cryptographic_nonce">http://en.wikipedia.org/wiki/Cryptographic_nonce</A>), but that's just me.<BR>
<BR>
In any case, even if a request nonce isn't added, I’d like to see openid.nonce renamed to openid.response_nonce.<BR>
<BR>
--David<BR>
<BR>
<BR>
-----Original Message-----<BR>
From: specs-bounces@openid.net on behalf of Dick Hardt<BR>
Sent: Sat 9/30/2006 4:57 PM<BR>
To: specs@openid.net<BR>
Subject: [PROPOSAL] request nonce and name<BR>
<BR>
Motivating Use Case<BR>
----------------------------<BR>
It is useful for an RP to know that a response to a request has <BR>
already been processed and is not stale.<BR>
A standard way to do this that can be incorporated into the Libraries <BR>
would simplify things for the RP implementor<BR>
<BR>
<BR>
Proposed Implementation<BR>
-----------------------------------<BR>
1) Allow the RP to OPTIONALLY include a nonce in the request. The <BR>
nonce would be of the same format as the nonce in the response from <BR>
the IdP. The IdP will include the nonce from the RP in its response.<BR>
<BR>
2) rename openid.nonce to openid.response_id and name the request <BR>
nonce openid.request_id<BR>
<BR>
Alternate: call them openid.response_stamp and openid.request_stamp<BR>
<BR>
naming comments:<BR>
+ openid.nonce is not in use at this time, so easy to rename<BR>
+ id or stamp may make more sense to the average developer (mainly <BR>
crypto and security people know what a nonce is, I have to explain to <BR>
most developers)<BR>
<BR>
<BR>
_______________________________________________<BR>
specs mailing list<BR>
specs@openid.net<BR>
<A HREF="http://openid.net/mailman/listinfo/specs">http://openid.net/mailman/listinfo/specs</A><BR>
<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>