Re: non authenticated alternate services (was Re: AD review of draft-ietf-httpbis-alt-svc-10)

On Sun, Jan 17, 2016 at 7:23 PM, Mark Nottingham <mnot@mnot.net> wrote:

> > What is "strongly authenticate" ? It may be read that some kind
> certificate must be always
> > required.
>
> We're leaving that intentionally vague.
>

I think the problem is that it doesn't feel very vague - strongly
authenticate should principally mean via crypto auth.. so I think its a
notch stronger than we're looking for here. The other confusing bit is
that, using the proposed .w-k approach, you're not really authenticating
the alternate as much as you're authenticating that alternate is valid for
the whole origin (as you indicate below).


>
> If the phrase "strong authentication" is making this hard to understand,
> we might use something else (e.g., "have reasonable assurances that the
> alternative service is under control of the origin").
>

that's better. maybe tweak with the "valid for the whole origin" concept?
That would certainly include both valid cert as well as the .wk approach..