Re: HTTP Signatures specification updated

On 02/11/2014 01:34 AM, Norbert Bollow wrote:
> A specification's demand for a transaction / message ID which is 
> required to be unique and increasing is *much* easier to satisfy in a
> portable manner than a requirement for “a nano-second precise 
> datetime value.”

Yes, that's true. However, we could be very lax about the "nano-second
precise" bit of it. No one has to know if you have a nanosecond precise
time source or not. If you don't, just implement a message ID counter
and dump that in the nanosecond field. See this email for a further
explanation:

http://lists.w3.org/Archives/Public/public-webpayments/2014Mar/0005.html

If we take this approach, we don't need a nonce spec. If we take the
Message ID approach, we need a nonce spec. Trying to cut down on the
amount of work that needs to be done and code implemented for this
stuff. I also realize that this is being nitpicky, and could live w/ the
nonce-approach if that's where consensus is.

-- manu

-- 
Manu Sporny (skype: msporny, twitter: manusporny, G+: +Manu Sporny)
Founder/CEO - Digital Bazaar, Inc.
blog: The Worlds First Web Payments Workshop
http://www.w3.org/2013/10/payments/

Received on Monday, 3 March 2014 02:06:21 UTC