[Ace] Re: AD review and IETF LC for draft-ietf-ace-revoked-token-notification

[Marco Tiloca <[e-mail]>]

Hello Paul,

Thanks a lot for your AD review! Please find in line below our reply to 
your comment.

A Github PR is also available at [PR].

Unless any concern is raised, we plan to soon merge this PR (and the 
other ones related to other received reviews, to which we'll also reply 
shortly), and to submit the result as version -07 of the document.

Thanks,
/Marco

[PR] https://github.com/ace-wg/ace-revoked-token-notification/pull/3


On 2024-03-15 02:56, Paul Wouters wrote:
> Hi,
>
> I've done my AD review of draft-ietf-ace-revoked-token-notification.
>
> The document looks good, I only have a minor question, which can be 
> answered during the IETC LC process.
>
>
> Section 13.2 states:
>
>         Issuing access tokens with not too long expiration time could
>         help reduce the size of the TRL, but an AS SHOULD take measures
>         to limit this size.
>
> I don't really understand what this is trying to say. What "measures", 
> other than short expiry times, can an AS take ?

==>MT

The intent was actually to suggest nothing more than limiting the 
lifetime of issued access tokens, but the original phrasing was unclear. 
We have rephrased as follows.

OLD:
 > Issuing access tokens with not too long expiration time could help 
reduce the size of the TRL, but an AS SHOULD take measures to limit this 
size.

NEW:
 > Therefore, in order to help reduce the size of the TRL, the AS SHOULD 
refrain from issuing access tokens with an excessively long expiration time.

<==

>
>
> Paul

-- 
Marco Tiloca
Ph.D., Senior Researcher

Phone: [phone]

RISE Research Institutes of Sweden AB
Box 1263
164 29 Kista (Sweden)

Division: Digital Systems
Department: Computer Science
Unit: Cybersecurity

https://www.ri.se