Re: Referencing ETLD+1.

There may also be an opportunity to align with the DNS specifications, 
which have the analogous concept of "delegation-centric zone" (cf. 
https://tools.ietf.org/html/rfc7719#page-16 ).


On 05/10/2018 11:19 AM, Patrick McManus wrote:
> A further refinement if you just want to define etld+1, (but I think 
> you need the previous one for 'how to bind cookies' - but that might 
> just be a distraction for you.)
> https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#terminology 
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__httpwg.org_http-2Dextensions_draft-2Dietf-2Dhttpbis-2Drfc6265bis.html-23terminology&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=-o8MJF7i0TzXAJRB0ncfTVfWKSyTG7nl_iTLU_A2B7c&m=yzrLlKRxElIcQkuxiEY3pvQZ3pbY0S-TG1OKbsNhYLQ&s=Qj8OTv1qz-idFYIn2uzeNNOzyPvQvw502q4GKNUmQNE&e=>
>
> "The term “public suffix” is defined in a note in Section 5.3 of 
> [RFC6265] 
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__httpwg.org_http-2Dextensions_draft-2Dietf-2Dhttpbis-2Drfc6265bis.html-23RFC6265&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=-o8MJF7i0TzXAJRB0ncfTVfWKSyTG7nl_iTLU_A2B7c&m=yzrLlKRxElIcQkuxiEY3pvQZ3pbY0S-TG1OKbsNhYLQ&s=cf5d9JvDL4XR2S_dh6YUyLoFhrAp3dKQHbFUFuSMTfo&e=> 
> as “a domain that is controlled by a public registry”, and are also 
> know as “effective top-level domains” (eTLDs). For example, 
> example.com <http://example.com>’s public suffix is com. User agents 
> SHOULD use an up-to-date public suffix list, such as the one 
> maintained by Mozilla at [PSL] 
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__httpwg.org_http-2Dextensions_draft-2Dietf-2Dhttpbis-2Drfc6265bis.html-23PSL&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=-o8MJF7i0TzXAJRB0ncfTVfWKSyTG7nl_iTLU_A2B7c&m=yzrLlKRxElIcQkuxiEY3pvQZ3pbY0S-TG1OKbsNhYLQ&s=JTwXYs4coubIOQzP7nVBzy43CP-YkTMCyEWZyV7cq7c&e=>. 
>
>
> An origin’s “registered domain” is the origin’s host’s public suffix 
> plus the label to its left. That is, for https://www.example.com, the 
> public suffix is com, and the registered domain is example.com 
> <http://example.com>. This concept is defined more rigorously in [PSL] 
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__httpwg.org_http-2Dextensions_draft-2Dietf-2Dhttpbis-2Drfc6265bis.html-23PSL&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=-o8MJF7i0TzXAJRB0ncfTVfWKSyTG7nl_iTLU_A2B7c&m=yzrLlKRxElIcQkuxiEY3pvQZ3pbY0S-TG1OKbsNhYLQ&s=JTwXYs4coubIOQzP7nVBzy43CP-YkTMCyEWZyV7cq7c&e=>, 
> and is also know as “effective top-level domain plus one” (eTLD+1)."
>
>
>
>
> On Thu, May 10, 2018 at 5:01 PM, Patrick McManus <mcmanus@ducksong.com 
> <mailto:mcmanus@ducksong.com>> wrote:
>
>     Perhaps Mark or Mike West will have a better idea, but I think
>     what you need is in the active 6265bis work:
>     https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#storage-model
>     <https://urldefense.proofpoint.com/v2/url?u=https-3A__httpwg.org_http-2Dextensions_draft-2Dietf-2Dhttpbis-2Drfc6265bis.html-23storage-2Dmodel&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=-o8MJF7i0TzXAJRB0ncfTVfWKSyTG7nl_iTLU_A2B7c&m=yzrLlKRxElIcQkuxiEY3pvQZ3pbY0S-TG1OKbsNhYLQ&s=JhUKutYkjHg6Hhfxm__XggYezkp5cNwuIX8zd3o5tFQ&e=>
>
>     6265bis is making very slow (but steady) progress - taking a
>     normative dependency on its completion would have, imo, a
>     predictable consequence of blocking publication of token binding
>     for quite a while. While there hasn't been a consensus call on the
>     language in that section of 6265bis there is no controversy around
>     it (other than the normal iterative vs declarative style
>     questions)- so my advice would be to use it as a template for
>     describing what you need and engaging the author and http wg for
>     review and any updates that might be required.
>
>     Sorry I don't have a better pointer at hand. Perhaps someone will
>     come up with a normative source.
>
>     -P
>
>
>
>
>     On Thu, May 10, 2018 at 4:26 PM, Eric Rescorla <ekr@rtfm.com
>     <mailto:ekr@rtfm.com>> wrote:
>
>         Hi HTTP WG members,
>
>         https://tools.ietf.org/html/draft-ietf-tokbind-https-15
>         <https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_draft-2Dietf-2Dtokbind-2Dhttps-2D15&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=-o8MJF7i0TzXAJRB0ncfTVfWKSyTG7nl_iTLU_A2B7c&m=yzrLlKRxElIcQkuxiEY3pvQZ3pbY0S-TG1OKbsNhYLQ&s=I3FBbAaHs50ovXXf_o_YdfHiq_y2X0-rKRSzSV8oRtE&e=>
>         says:
>
>            The scoping of Token Binding key pairs generated by Web
>         browsers for
>            use in first-party and federation use cases defined in this
>            specification (Section 5), and intended for binding HTTP
>         cookies,
>            MUST be no wider than the granularity of "effective
>         top-level domain
>            (public suffix) + 1" (eTLD+1).  I.e., the scope of Token
>         Binding key
>            pairs is no wider than the scope at which cookies can be
>         set (see
>            [RFC6265]), but MAY be more narrow if cookies are scoped more
>            narrowly.
>
>         Alissa points out that somewhat surprisingly 6265 doesn't actually
>         say this. We obviously want the binding to be tied to eTLD+1, so
>         the question is really how we write this up. Could the HTTP WG
>         provide
>         some guidance here?
>
>         -Ekr
>
>
>
>