Require encryption?

[rfc2822]

Consequences, like that we don't have to keep sensitive information like URLs out of the topic

[rfc2822]

Since we use Web Push as primary transport and RFC 8030 requires end-to-end encryption, we should also require it.

As a consequence, we can trust the push message body to be confidential.

[rfc2822]

Re-opened because we have to clarify whether

• VAPID is required or only recommended (especially because it's currently possible to use UnifiedPush without VAPID),
• Message Encryption is required or only recommended,
• or if other methods of providing a security context for Web Push are sufficient,
• whether it should be possible to use a UnifiedPush setup that doesn't meet all Web Push requirements (for instance, UP without VAPID and Message Encryption, but all on own servers), and
• whether the server-public-key should be renamed to vapid-public-key for clarity.

[rfc2822]

Seems that UnifiedPush AND_3.0.0

• allows VAPID (distributors may require VAPID)
• requires Message Encryption

[rfc2822]

There are different encryption methods (namely legacy aesgcm and aes128gcm, which is mentioned in RFC 8291 and defined in RFC 8188), so I think we should

• only use aes128gcm because that's the current one in the standards,
• have a parameter for encryption type (content coding) when the client registers the subscription at the WebDAV-Push server, with the fixed value aes128gcm, which could be modified when other codings emerge.

[rfc2822]

VAPID now recommended, Message Encryption required.