Draft: draft-ietf-privacypass-protocol

Commentary: Thanks , I applied some suggestions on top . I think this is an improvement , but will wait for some others to take a look , too .
This document specifies two variants of the the two-message issuance
protocol for Privacy Pass tokens: one that produces tokens that are
privately verifiable using the issuance private key, and another that
produces tokens that are publicly verifiable using the issuance
public key.
This document specifies two variants of the two-message issuance
protocol for Privacy Pass tokens: one that produces tokens that are
privately verifiable using the issuance private key, and another that
produces tokens that are publicly verifiable using the issuance
public key.
Client: An entity that provides authorization tokens to services
across the Internet, in return for authorization.
Issuer: A service that produces Privacy Pass tokens to clients.
Private Key: The secret key used by the Issuer for issuing tokens.
Public Key: The public key used by the Issuer for issuing and
verifying tokens.
Client: An entity that runs the Issuance protocol with an Issuer
to produce Tokens that can be later used for redemption (see
Section 2.2 of AUTHSCHEME).
Issuer: A service that provides Tokens to Clients.
Issuer Public Key: The public key (from a private-public key pair)
used by the Issuer for issuing and verifying Tokens.
Issuer Private Key: The private key (from a private-public key
pair) used by the Issuer for issuing and verifying Tokens.
This document additionally uses the terms "Origin" and "Token" as
defined in ARCHITECTURE.
Issuer Public Key values: An Issuer Public Key for an issuance
protocol.
The Issuer parameters can be obtained from an Issuer via a directory
object, which is a JSON object RFC8259, Section 4 whose values are
other JSON values RFC8259, Section 3 for the parameters.
Issuer Public Key values: A list of Issuer Public Keys for the
issuance protocol.
The Issuer parameters can be obtained from an Issuer via a directory
object, which is a JSON object (RFC8259, Section 4) whose values are
other JSON values (RFC8259, Section 3) for the parameters.
The Privacy Pass issuance protocol is a two message protocol that
takes as input a TokenChallenge from the redemption protocol
AUTHSCHEME, Section 2.1 and produces a Token AUTHSCHEME, Section 2.2,
as shown in the figure below.
Issuers provide a Private and Public Key, denoted skI and pkI,
respectively, used to produce tokens as input to the protocol.  See
issuer-configuration for how this key pair is generated.
Issuer Public Key pkI, with a key identifier "token_key_id"
computed as described in issuer-configuration.
The Privacy Pass issuance protocol is a two-message protocol that
takes as input a TokenChallenge from the redemption protocol
(AUTHSCHEME, Section 2.1) and produces a Token (AUTHSCHEME,
Section 2.2), as shown in the figure below.
Issuers provide a Private and Public Key, denoted "skI" and "pkI"
respectively, used to produce tokens as input to the protocol.  See
issuer-configuration for how this key-pair is generated.
Issuer Public Key: "pkI", with a key identifier "token_key_id"
computed as described in issuer-configuration.
The constants "Ne" and "Ns" are as defined in OPRF, Section 4 for
OPRF(P-384, SHA-384).
The Blind function is defined in OPRF, Section 3.3.2.  If the Blind
function fails, the Client aborts the protocol.  The Client stores
the nonce and challenge_digest values locally for use when finalizing
the issuance protocol to produce a token (as described in private-
finalize).
The Blind function is defined in OPRF, Section 3.3.2.  If the Blind
function fails, the Client aborts the protocol.  The Client stores
the "nonce" and "challenge_digest" values locally for use when
finalizing the issuance protocol to produce a token (as described in
private-finalize).
"blinded_msg" is the Ne-octet blinded message defined above,
computed as "SerializeElement(blinded_element)".  Ne is as defined
in OPRF, Section 4.
"truncated_token_key_id" is the least significant byte of the
"token_key_id" (issuer-configuration) in network byte order (in
other words, the last 8 bits of "token_key_id").
"blinded_msg" is the Ne-octet blinded message defined above,
computed as "SerializeElement(blinded_element)".
"evaluate_msg" is the Ne-octet evaluated messaged, computed as
"SerializeElement(evaluate_element)".
"evaluate_proof" is the (Ns+Ns)-octet serialized proof, which is a
pair of Scalar values, computed as
"concat(SerializeScalar(proof[0]), SerializeScalar(proof[1]))",
where Ns is as defined in OPRF, Section 4.
"evaluate_msg" is the Ne-octet evaluated message, computed as
"SerializeElement(evaluate_element)".
"evaluate_proof" is the (Ns+Ns)-octet serialized proof, which is a
pair of Scalar values, computed as
"concat(SerializeScalar(proof[0]), SerializeScalar(proof[1]))".
Issuer Public Key pkI, with a key identifier "token_key_id"
computed as described in public-issuer-configuration.
Issuer Public Key: "pkI", with a key identifier "token_key_id"
computed as described in public-issuer-configuration.
The Client then generates an HTTP POST request to send to the Issuer,
with the TokenRequest as the content.  The media type for this
request is "application/private-token-request".  An example request
is shown below, where Nk = 512.
"truncated_token_key_id" is the least significant byte of the
"token_key_id" (public-issuer-configuration) in network byte order
(in other words, the last 8 bits of "token_key_id").
To verify a token, a verifier checks that Token.authenticator is a
valid signature over the remainder of the token input using the
Issuer Public Key. The function "RSASSA-PSS-VERIFY" is defined in
Section 8.1.2 of RFC8017, using SHA-384 as the Hash function, MGF1
with SHA-384 as the PSS mask generation function (MGF), and a 48-byte
salt length (sLen).
Verifying a Token requires checking that Token.authenticator is a
valid signature over the remainder of the token input using the
Issuer Public Key. The function "RSASSA-PSS-VERIFY" is defined in
Section 8.1.2 of RFC8017, using SHA-384 as the Hash function, MGF1
with SHA-384 as the PSS mask generation function (MGF), and a 48-byte
salt length (sLen).