Re: HTTP Signatures specification updated

On 2014-02-11 02:14, Manu Sporny wrote:
> On 02/08/2014 12:29 AM, Anders Rundgren wrote:
>>> Dates don't suffice, true... but what about ISO 8601 datetimes that
>>> have nanosecond precision?
>>
>> I wouldn't go there because it could be (by some people) called a
>> "kludge" and become a hurdle in a standardization process.
> 
> Hmm, I'd like to hear the argument of why they're a kludge. Many nonce
> systems utilize an incrementing counter, I don't see why this mechanism
> would be any different.
> 
>> Anyway, it is actually a bit nice to have a separate
>> transaction/message ID which for example could be strictly
>> sequential.  The syntax should preferably be limited to Base64.
> 
> I don't see how a sequentially incrementing transaction / message ID
> would be different from a nano-second precise datetime value.

As I wrote, from a strict technical point of view this is entirely correct.

The difference as I see it is that a DateTime says "when" while a MessageID
uniquely identifies the actual message from the sender's perspective
like for example a PO number.

Nanosecond time-stamps are (de-facto) non-standard which is another
possible objection to the current scheme.

Anders


> 
> -- manu
> 

Received on Tuesday, 11 February 2014 04:46:59 UTC