Subject: [Ohai] Updated OHTTP draft

From: "Martin Thomson" <[email-masked]>
Date: Tue, 26 Oct 2021 11:21:39 +1100

Hey everyone,

I've just pushed a no-op revision of the oblivious HTTP so that it has a recognizable working group name.

https://www.ietf.org/archive/id/draft-thomson-ohai-ohttp-00.html

I'd like to take this opportunity to list a few of the issues that I think we should be discussing in the event that this work is adopted.  Here are the items that I think are most interesting:

1. Streaming request/responses
https://github.com/unicorn-wg/oblivious-http/issues/75
Should we add the ability to stream messages?

2. Additional data
https://github.com/unicorn-wg/oblivious-http/issues/70
What additional data might need to be exposed to the proxy or server on the *outside* of the encrypted envelope?

3. Anti-replay
https://github.com/unicorn-wg/oblivious-http/issues/76
How might we better protect against replay attacks?

4. Shadow banning
https://github.com/unicorn-wg/oblivious-http/issues/66
Should we allow proxies to "secretly" signal regarding potentially abusive clients so that shadow banning might be implemented?

5. Intermediary visibility
https://github.com/unicorn-wg/oblivious-http/issues/61
Are there things we might do differently to ensure that intercepting intermediaries are better able to identify that this is in use?  For instance, this issue suggests a new method rather than just a media type.

There are a few other issues that are more minor, but these are the ones that will make substantial differences to the shape of the spec.