Subject: [Webpush] Composite Crypto-Key composition issue

From: JR Conlin <[email-masked]>
Date: Tue, 28 Jun 2016 09:24:15 -0700

I believe there may be some confusion about how to create a composite
Crypto-Key header.

The Crypto-Key Header is used by several supporting protocols of WebPush
(ECE, VAPID). The respective specifications state that the field uses RFCs
7230 & 7231 where each parameter list set is divided by commas, and each
individual parameter is divided by a semicolon.

The confusion arises in whether or not each list set should contain items
specific for a given sub-protocol.

For instance, our autopush server treats ECE and VAPID as separate entities
and divides the set containing the dh= parameter from the set containing
p256ecdsa=. It's my understanding that FCM does not follow this practice
and will generate an error if a "," appears in the Crypto-Key parameter
lists.

Since this is a point of confusion and conflict, I believe it would be in
the best interests of all if this was addressed in some manner so that
future conflict and confusion can be avoided.

(For what it's worth, I really don't care what the answer is; keep protocol
parameter sets distinct to avoid potential future conflicts or combine all
parameters into one big ol' hash. Just want to prevent future folk from
swearing at us.)

---

From: Peter Beverloo <[email-masked]>
Date: Tue, 28 Jun 2016 17:30:53 +0100

Looks like we sent an e-mail at exactly the same time[1] about the same
issue, proposing the same solution :-).

I've created the following GitHub issue with a proposed PR to address the
issue:
    https://github.com/webpush-wg/webpush-encryption/issues/6

Thanks,
Peter

[1]
https://mailarchive.ietf.org/arch/msg/webpush/UAbPwhb-_iu5Q4Ak9vE8sJKy4Ss

On Tue, Jun 28, 2016 at 5:24 PM, JR Conlin <[email-masked]> wrote:

> For instance, our autopush server treats ECE and VAPID as separate
> entities and divides the set containing the dh= parameter from the set
> containing p256ecdsa=. It's my understanding that FCM does not follow this
> practice and will generate an error if a "," appears in the Crypto-Key
> parameter lists.
>
> (For what it's worth, I really don't care what the answer is; keep
> protocol parameter sets distinct to avoid potential future conflicts or
> combine all parameters into one big ol' hash. Just want to prevent future
> folk from swearing at us.)
>
> _______________________________________________
> Webpush mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/webpush
>
>