[Ace] Deb Cooley's No Objection on draft-ietf-ace-revoked-token-notification-08: (with COMMENT)

[Deb Cooley via Datatracker <[e-mail]>]

Deb Cooley has entered the following ballot position for
draft-ietf-ace-revoked-token-notification-08: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ace-revoked-token-notification/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you to Kyle Rose for doing the secdir review of this draft.  Also thanks
to the authors for the discussions and improvements.

I have one last (easy?) question:

Section 13:  I expected to see some discussion on whether it is possible for an
attacker to remove a revoked access token from the TRL allowing a registered
device with a revoked access token to continue to participate.  Conversely, is
it possible for an attacker to add an access token to the TRL, which would deny
service to the registered device.  If these situations are not possible, what
feature protects the TRL both at the AS and in transit?