IETF Logo Mail Archive

Re: [COSE] Éric Vyncke's No Objection on draft-ietf-cose-cwt-claims-in-headers-09: (with COMMENT)

Paul Wouters <paul.wouters@aiven.io> Wed, 29 November 2023 14:51 UTC

Return-Path: <paul.wouters@aiven.io>
X-Original-To: cose@ietfa.amsl.com
Delivered-To: cose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA0A6C14CE55 for <cose@ietfa.amsl.com>; Wed, 29 Nov 2023 06:51:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.106
X-Spam-Level:
X-Spam-Status: No, score=-2.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=aiven.io
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id koorpRFTiebx for <cose@ietfa.amsl.com>; Wed, 29 Nov 2023 06:51:20 -0800 (PST)
Received: from mail-ej1-x629.google.com (mail-ej1-x629.google.com [IPv6:2a00:1450:4864:20::629]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3053CC151063 for <cose@ietf.org>; Wed, 29 Nov 2023 06:51:20 -0800 (PST)
Received: by mail-ej1-x629.google.com with SMTP id a640c23a62f3a-a02ba1f500fso979195766b.0 for <cose@ietf.org>; Wed, 29 Nov 2023 06:51:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aiven.io; s=google; t=1701269478; x=1701874278; darn=ietf.org; h=to:in-reply-to:cc:references:message-id:date:subject:mime-version :from:content-transfer-encoding:from:to:cc:subject:date:message-id :reply-to; bh=5KGYieAn6YyTBxMPh3iTwy7LH+9vwF5Tnr7tDJMqOSU=; b=KtAUznbCXy9eS4yzlO3iKCwcBjKScSZyLV6BaWo6GvgK3rWdnoEkWh2EJ/jcOJ0j7M J1gymMmUbLADgO0R/zyNY7NqkNX7IQvaBbpEhsajLuNLXJmr7RhUEY3khNv7Y4VyVT0P xdePgPFRiMw6Vo7bZp/1ROD+CpkutLJCwVv44=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701269478; x=1701874278; h=to:in-reply-to:cc:references:message-id:date:subject:mime-version :from:content-transfer-encoding:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=5KGYieAn6YyTBxMPh3iTwy7LH+9vwF5Tnr7tDJMqOSU=; b=IT3prIF/kjA1Fe+a+1aXkrCiKPbxneJrZHCEX4nMaM8d/F9Sbs5g1IiRfrz9hnNLWf JDr2+SyVj6yHnW2TJSlYYI+o/4JdctSXW2J4aX98ZEfJmr6ZgqcoGDPFmjipoQHg3cbq BPuNcfTZxx/jkNxT2LXf8En1liWY4z6w6qrp/uI1bGWRAyeUP98RS8uQOA5ST0T1JuoT eAb6IrCwHOGk4ByxpD0MOwk09UgCGjG6g4PkR5YHmzhuNjri2tvuG1dUQg2iXVYdlJ1D OZiAaVqOynLZXiysFFgDQuhwEORHDrCfp/MNy2yhfleYtV0rI+pKK9ZkDnrzLjnl3vHL ykiQ==
X-Gm-Message-State: AOJu0Ywubn7pWQ8bZ/55H5CdyW4wYdrPR5NhnDjwC4v8DFTk71g5q0NR BC9A9z8QLN2wBSFC2xPlFdusOhUZgk/uIdJ6mKb41RK/IaVUMEWz24FibaGf1RRyeMGqRGhNuGv eheeTpCCbB4O0vqlxdZQrmu4AcuQRkr/PG97xppr9ul07W5YbMD5E+2mE0jV4UG4g7W04s0A=
X-Google-Smtp-Source: AGHT+IE6uIFUHXl2U9Bj00WjoJM6RSlHWcueU3N2VnqjZ/ioRI7rvXvnomJSPqOxnOreuvzqN/cDPw==
X-Received: by 2002:a17:906:2287:b0:9fc:4c88:a723 with SMTP id p7-20020a170906228700b009fc4c88a723mr13883425eja.26.1701269477824; Wed, 29 Nov 2023 06:51:17 -0800 (PST)
Received: from smtpclient.apple ([74.122.52.94]) by smtp.gmail.com with ESMTPSA id m16-20020a17090679d000b009fcf9f8e526sm7923451ejo.25.2023.11.29.06.51.17 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 29 Nov 2023 06:51:17 -0800 (PST)
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From: Paul Wouters <paul.wouters@aiven.io>
Mime-Version: 1.0 (1.0)
Date: Wed, 29 Nov 2023 09:51:02 -0500
Message-Id: <A53D7AD6-A640-46FA-92FC-AE2934D7B4BD@aiven.io>
References: <600298.1701266249@dyas>
Cc: Michael Jones <michael_b_jones@hotmail.com>, =?iso-8859-1?Q?=C9ric_Vyncke?= <evyncke@cisco.com>, The IESG <iesg@ietf.org>, draft-ietf-cose-cwt-claims-in-headers@ietf.org, cose-chairs@ietf.org, cose@ietf.org, mprorock@mesur.io, orie@transmute.industries, Hannes.Tschofenig@gmx.net
In-Reply-To: <600298.1701266249@dyas>
To: Michael Richardson <mcr+ietf@sandelman.ca>
X-Mailer: iPhone Mail (21B91)
Archived-At: <https://mailarchive.ietf.org/arch/msg/cose/URoT0ckUOzb3DV84gGuhsLIkVqc>
X-Mailman-Approved-At: Wed, 29 Nov 2023 10:39:35 -0800
Subject: Re: [COSE] Éric Vyncke's No Objection on draft-ietf-cose-cwt-claims-in-headers-09: (with COMMENT)
X-BeenThere: cose@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: CBOR Object Signing and Encryption <cose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/cose>, <mailto:cose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cose/>
List-Post: <mailto:cose@ietf.org>
List-Help: <mailto:cose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/cose>, <mailto:cose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Nov 2023 14:51:24 -0000

On Nov 29, 2023, at 08:57, Michael Richardson <mcr+ietf@sandelman.ca> wrote:
> 
> 
> Michael Jones <michael_b_jones@hotmail.com> wrote:
>> is only used to impose normative requirements in the main body of the
>> specification and not in the Privacy Considerations or Security
>> Considerations, which are just that: things to consider - not normative
>> requirements.
> 
> I also think it's bad form to make implementers find the MUSTs in the
> considerations.  They should be in the main body, and just referred to in the
> Considerations.
>   "Because we do XYZ (Section ABC), we are therefore immune to attacks my giant spiders"

I think MUSTs can be fine in the security considerations, eg “random MUST be from a secure source”, but a protocol document should be fully implementable without reading any Considerations section. These sections are additional advice to implementors.


Paul

v2.23.0 | Report a Bug | By Email