Re: [appsdir] Scans for draft-ietf-tokbind-protocol and draft-ietf-tokbind-https

[Eliot Lear <[e-mail]>]

Thank you both.  I will work with the reviewer on timing based on your
advice, Martin.

Eliot

On 4/8/15 6:38 PM, Martin Thomson wrote:
> FYI, I've been paying attention to these.  They certainly need a lot
> of attention.  I have suggested several changes that - if they are
> accepted - will completely change the structure of the two drafts.
> One of those proposed changes is a merge of the drafts.  The authors
> have accepted the need to change the negotiation portion in -protocol
> entirely.
>
> Attention is definitely warranted, but some delay might avoid some churn.
>
> On 7 April 2015 at 17:15, Ted Hardie <[e-mail]> wrote:
>> draft-ietf-tokbind-protocol will need significant attention, especially from
>> folks with application security, privacy,  and web services backgrounds.
>> Though the draft isn't very long, it describes a general method of binding
>> application security tokens to a channel and reusing them with a server as
>> well as methods for taking those issued by one server and using them
>> elsewhere.  The interaction between the binding and application semantics
>> will likely be a focus of reviews, as would be the privacy implication of a
>> long-lived token of this type (though the draft presumes the ability to
>> clear state, it's not at all clear that this would be available to mobile
>> apps or similar).
>>
>> draft-ietf-tokbind-https will need a similar amount of attention, especially
>> from folks familiar with HTTP semantics (headers and status code semantics
>> being two areas of concern).  In essence, this is the worked example of the
>> protocol, embodied in HTTP.
>>
>> regards,
>>
>> Ted
>>
>> _______________________________________________
>> appsdir mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/appsdir
>>
> _______________________________________________
> appsdir mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/appsdir
>
>