[Acme] Re: Mohamed Boucadair's No Objection on draft-ietf-acme-device-attest-08: (with COMMENT)

[Corey Bonnell <[e-mail]>]

Hi Mohamed,
Thank you for the additional review. Replies inline:

> Display format: mismatch type vs. payload
> Content-Type: application/jose+json

The content-type as mandated by RFC 8555 is "application/jose+json", so the document is correct.

> Can we please add some text to explain how the displayed payload should be interpreted.

The document follows the convention established in RFC 8555, namely section 7.5.1 (https://datatracker.ietf.org/doc/html/rfc8555#section-7.5.1) for presenting payloads, so I don't see the benefit in an alternate presentation. 

Thanks,
Corey



Jul 16, 2026, 03:56 by [e-mail]:

> Mohamed Boucadair has entered the following ballot position for
> draft-ietf-acme-device-attest-08: No Objection
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
> for more information about how to handle DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-acme-device-attest/
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> Hi Brandon, Ganesh, Sven, Corey, and Ryan,
>
> The changes [1] address almost all the comments [2]. I ACK that the authors
> will remove RFC8809 from the normative references.
>
> I still think a change is needed for this one:
>
> # Display format: mismatch type vs. payload
>
> CURRENT:
>  Content-Type: application/jose+json
>
>  {
>  "protected": base64url({
>  "alg": "ES256",
>  "kid": "https://example.com/acme/acct/evOfKhNU60wg",
>  "nonce": "SS2sSl1PtspvFZ08kNtzKd",
>  "url": "https://example.com/acme/chall/Rg5dV14Gh1Q"
>  }),
>  "payload": base64url({
>  "attObj": base64url(/* WebAuthn attestation object */),
>  }),
>  "signature": "Q1bURgJoEslbD1c5...3pYdSMLio57mQNN4"
>  }
>
> Can we please add some text to explain how the displayed payload should be
> interpreted.
>
> Better, maybe update the example to follow the convention used in the examples
> in RFC7515.
>
> Cheers,
> Med
>
> [1]
> https://author-tools.ietf.org/iddiff?url1=draft-ietf-acme-device-attest-07&url2=draft-ietf-acme-device-attest-08&difftype=--html
>
> [2] https://mailarchive.ietf.org/arch/msg/acme/0O-8TlKh0j3hRw-JLBOWyXCF-Aw/
>
>
>
> _______________________________________________
> Acme mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>