fix(verification/api): Return URL-safe nonce in challenge response sessions

[cowbon]

ratsd uses URL-safe base64 encoded nonce instead of standard encoded base64. See veraison/ratsd#37. Align the implementation so the nonce can be used directly from the /challenge-response/v1/newSession response body

[yogeshbdeshpande]

please have a look!

[yogeshbdeshpande]

@cowbon : I am not clear about this change, can we have a meeting today to understand the change?

As far as I understand, Verifier does two things.

1. If it receives a Nonce Bytes, from RP it checks if it is URL Safe to Encode and then uses it, inside Session
2. If the Verifier receives nonce Size then it check for Size validity and uses to mint a URL safe Nonce value???

[cowbon]

@cowbon : I am not clear about this change, can we have a meeting today to understand the change?

As far as I understand, Verifier does two things.

1. If it receives a Nonce Bytes, from RP it checks if it is URL Safe to Encode and then uses it, inside Session
2. If the Verifier receives nonce Size then it check for Size validity and uses to mint a URL safe Nonce value???

Hi Yogesh, thanks for the info about the verifier design. However, /newSeesion issues the standard nonce, and the burden to convert standard nonce to URL-safe nonce is on the attester. If URL-safe nonce is preferred over the standard one, why can't the verifier issue an URL-safe nonce to avoid the additional step?

[yogeshbdeshpande]

Suggested change

	// Keep reading sessions created before the nonce wire format switched
	// from standard base64 to base64url.
	if nonce, stdErr := base64.StdEncoding.DecodeString(v); stdErr == nil {
	return nonce, nil
	}

[cowbon]

Hi @yogeshbdeshpande , thanks for sharing your thoughts. This should now reflected what we discussed.

[yogeshbdeshpande]

@cowbon : As discussed let us first fix the API documentation properly before proceeding correctly with this PR!

[cowbon]

@cowbon : As discussed let us first fix the API documentation properly before proceeding correctly with this PR!

See veraison/docs#78