<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Jan 27, 2014, at 9:04 AM, Nick Alexander <<a href="mailto:nalexander@mozilla.com">nalexander@mozilla.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On 1/24/2014, 4:42 PM, Chris Karlof wrote:<br><blockquote type="cite">in the least disruptive way!<br><br>1) Point the token server at the new verifier, which accepts legacy and new formats. This can happen at any time.<br>2) Patch the FxA Auth server to sign certs in the legacy or new format, depending on the format the public key it is given in the request. This can happen at any time after 1).<br>3) Patch clients to submit public keys in the new format to the FxA server.<br><br>Note: this plan requires the verifier to return extended IdP attributes for legacy FxA certs.<br><br>Thoughts?<br><br>Cloud ENG can do 1+2 now-ish and 3) can happen whenever the Sync effort gets in a happier spot.<br></blockquote><br>This is fine by me; I expect time to look at this for Android clients in about 10 days.<br><br>Being for the benefit of Mr Kite, do we have a spec for the new assertion format? I reverse engineered the old one from the verifier sources.<br><br></blockquote><div><br></div><div>Hi Nick,</div><div><br></div><div>Here's your resources:</div><div><br></div><div><a href="http://lloyd.io/evolving-browserid-data-formats/">http://lloyd.io/evolving-browserid-data-formats/</a></div><div><a href="https://github.com/mozilla/browserid-local-verify">https://github.com/mozilla/browserid-local-verify</a></div><div><br></div><div>The first one has additional links of interest.</div><div><br></div><div>-chris</div><div><br></div><div><br></div><br><blockquote type="cite">Nick<br></blockquote></div><br></body></html>