Describe how to transform a key id into an actor id

[evanp]

I think the algorithm is roughly:

If the key ID has a fragment...

• fetch the resource at the HTTPS URL
• look for a property with the same name as the fragment
• get the owner of that property

If the key ID does not have a fragment...

• fetch the resource at the HTTPS URL
• get the owner of that resource

[perillamint]

Also, I think the following constraints would be necessary:

• keyid MUST be a valid URI
• keyid MUST have the same authority as actor id (To enforce server ban much more effectively AND prevent identity spoofing)
• Validator MUST reject if an actor's keyid does not meet the criteria.

For the keyid without fragment... I think it should (or must) be discouraged, because it will prevent us having multiple key slot in the future.

[evanp]

For the keyid without fragment... I think it should (or must) be discouraged, because it will prevent us having multiple key slot in the future.

I don't think that's true at all. https://social.example/key/1 and https://social.example/key/2 can have the same owner property.

Also, publicKey can have multiple values.

[snarfed]

Also, publicKey can have multiple values.

@evanp publicKey is https://w3c-ccg.github.io/security-vocab/#publicKey , right? Can you describe briefly how to confirm that it can be multiply valued? I'd like to incorporate that into #8 (comment).

[snarfed]

(I expect any conclusion here this to be incorporated in the draft text in #8 (comment).)

[tesaguri]

Also, publicKey can have multiple values.

publicKey is https://w3c-ccg.github.io/security-vocab/#publicKey , right? Can you describe briefly how to confirm that it can be multiply valued?

The property isn't defined to be "functional" (single-valued), and generally speaking, an RDF property not explicitly specified to be functional can have multiple values because the functionality is opt-in IIUC.

And that seems to actually match the intention of the Security Vocabulary spec, since the spec has a number of examples that use the term with an array value (search the spec for "publicKey": [!).

[snarfed]

Thanks @tesaguri!