Re: [Anima] Questions open after Last Call review of GRASP

[Brian E Carpenter <[e-mail]>]

Replying to myself, I have added a note to the first issue.

On 05/03/2017 15:51, Brian E Carpenter wrote:
> Hi,
> 
> We got two excellent reviews of draft-ietf-anima-grasp-09
> from Joel Halpern and Charlie Perkins. In fact the WG owes
> Charlie a big round of applause for the thoroughness of his
> review.
> 
> Of course, the authors will fix all the issues that are
> mistakes, omissions, or lack of clarity. We will get
> a -10 draft out before the deadline, which we hope people
> can check before the IETF.
> 
> There are three larger issues where WG or WG Chair or AD
> input is needed:
> 
> 1. Normative dependency on a draft.
> 
> We use CDDL, which is still far from being a published
> standards track RFC (draft-greevenbosch-appsawg-cbor-cddl).
> This could hold up the GRASP RFC indefinitely.
> 
> Proposed resolution: add an appendix specifying only
> the subset of CDDL we need. This has already been drafted
> so is quite feasible to do quickly.

Note: since we have other normative dependencies on drafts,
we could delay this change until later.

> 
> - Split the document? [Charlie Perkins]
> 
> "parts of the document seem more philosophical than
> prescriptive... It should be considered to break the document
> into a Requirements document and a more rigorously defined
> protocol solution document."
> 
> Proposed resolution: writing a separate requirements document
> was essentially excluded when the WG was chartered. Unless the
> WG and AD want to backtrack on that, the proposed resolution
> is to *not* do this. Of course, all the specific review comments
> about non-rigorous text will be actioned.
> 
> - Clarify security [Charlie Perkins]
> 
> "In some
> places, ACP seems to be mandated, and in other places that is relaxed
> to mean "a sufficient security mechanism".  It would be better to
> identify the security requirements, and put them unmistakably in the
> Security Considerations section, which deserves to have teeth."
> 
> (and various detailed comments in the text)
> 
> Of course we will deal with the detailed comments and fix the
> inconsistencies. The larger issue is whether we should move most
> of the security discussion to the Security Considerations section.
> 
> Speaking only for myself, I think it would be a mistake, because
> at the moment it seems to me that the security issues are
> mentioned where they most logically fit.
> 
> Proposed resolution: TBD
> 
>    Brian (as co-editor of the draft)
>