Multibase encoded Multihash for Digest Headers

[msporny]

I've spoken with @ioggstream about this before and was wondering what the status was for using multibase-encoded multihash values in the Digest header was?

Is now an appropriate time to pre-register the "mh" digest algorithm value in the Hypertext Transfer Protocol (HTTP) Digest Algorithm Values Registry? https://www.iana.org/assignments/http-dig-alg/http-dig-alg.xhtml

Would the HTTP WG be interested in moving multibase and multihash through the standardization process? Or would that be better accomplished in another WG? /cc @mnot

[LPardue]

Hey @msporny,

Including the multihash algorithm in the digest headers specification was a suggestion pre adoption (IIRC). Although it's obviously related, it always seemed one step too far to consider for what is a Digest spec revision.

I am not mnot, nor a HTTP WG chair, but I think the best option is for a standalone specification of some sorts to register multihash for Digest. As part of the Digest work, the IANA table is being tweaked, and a multihash registration doc would do well to target the new format.

An Internet-Draft is probably the best way to do this work, and I'd hope if someone published one that we would take discussion about it to the mailing list.

[msporny]

An Internet-Draft is probably the best way to do this work, and I'd hope if someone published one that we would take discussion about it to the mailing list.

Just to make sure I understand correctly... are you asking for a Multibase / Multihash spec to be published as an I-D? If so:

https://datatracker.ietf.org/doc/html/draft-multiformats-multibase
https://datatracker.ietf.org/doc/html/draft-multiformats-multihash (with an IANA considerations section that speaks to the Digest header)

or are you asking for an I-D that specifically does a Digest registration (I don't think there's such a thing, so I expect this is not what you're suggesting).

My concern here is that perhaps HTTP WG isn't the place to do multibase/multihash (but is the place to do the Digest registration), but if that's true, then where should multibase/multihash be done so that we can do a Digest registration?

[LPardue]

Many of the existing algorithms were defined outside of the HTTP WG. I think the important piece to define is the digest-value encoding, which is AFAUI self-describing for multihash, and might surprise people that assume it is base64 like some others.
I'm personally not that worried if the registration is done as part of draft-multiformats... or an entirely standalone doc. But keen to hear what others think.

My concern here is that perhaps HTTP WG isn't the place to do multibase/multihash (but is the place to do the Digest registration), but if that's true, then where should multibase/multihash be done so that we can do a Digest registration?

This is the high order bit, Might be something for chairs/ADs to help triage, or even going to dispatch/secdispatch.

[ioggstream]

Hi @msporny ! I think that the registration can be done directly into the multiformat spec or, if the wg suggests so, a separate I-D which I'm willing to support.
It would be great, in the meantime, to have some feedback on the implementation side wrt sending multiple mh representation-data-digest.
Another question: the draft/definition should support id-mh algorithms (eg. like id-sha256)

[msporny]

It would be great, in the meantime, to have some feedback on the implementation side wrt sending multiple mh representation-data-digest.

I don't think we use multiple mh representations for Digest anywhere in any of our systems. We tend to try to stick to one encoding, ideally base64url of SHA2-256 values. We are merely using mh because the one format will (hopefully) future proof us for many conceivable ways the industry might move over the next 10 years or so.

The marching instructions I got from our internal team that depends on mh in Digest was: "Make sure we can do base64url encoded SHA2-256 multihash values." ... so, support for something like this (no multiple uses of mh):

Digest: mh=uOTZXSHBudVd4bkNVR0wyV2ZreDhRVFFHemZ5QXJPdWI

Another question: the draft/definition should support id-mh algorithms (eg. like id-sha256)

I don't quite understand the question... could you please ask it in a different way?

[mnot]

The specs should go to dispatch or secdispatch (probably the latter? Ask the chairs...). HTTP WG would want to be consulted about the registrations, to make sure that how they hook into HTTP is correct.

Making them available as an I-D doesn't help with registration; they need to be adopted and on their way to publication as an RFC.

[LPardue]

I don't think there is anything for the digest spec to do here, so I'm going to close this issue.