Re: [Ace] Eric Rescorla's No Objection on draft-ietf-ace-cbor-web-token-13: (with COMMENT)

[Kathleen Moriarty <[e-mail]>]

Hi Mike and authors,

Could you please respond to see if we can wrap this up?

Thanks,
Kathleen

On Wed, Mar 7, 2018 at 3:40 PM, Eric Rescorla <[e-mail]> wrote:
> Eric Rescorla has entered the following ballot position for
> draft-ietf-ace-cbor-web-token-13: No Objection
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-ace-cbor-web-token/
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
>    The claim values defined in this specification MUST NOT be prefixed
>    with any CBOR tag.  For instance, while CBOR tag 1 (epoch-based date/
>    time) could logically be prefixed to values of the "exp", "nbf", and
>    "iat" claims, this is unnecessary, since the representation of the
>    claim values is already specified by the claim definitions.  Tagging
>    claim values would only take up extra space without adding
>    information.  However, this does not prohibit future claim
>    definitions from requiring the use of CBOR tags for those specific
>    claims.
>
> Why do you need a MUST NOT here? This seems like not really an interop requirement
>
>
>   4.  Verify that the resulting COSE Header includes only parameters
>        and values whose syntax and semantics are both understood and
>        supported or that are specified as being ignored when not
>        understood.
>
> I'm surprised to find that this is not a generic 8152 processing rule.
> Can you explain why this is necessary here?
>
>



-- 

Best regards,
Kathleen