IETF Logo Mail Archive

Re: [COSE] Éric Vyncke's No Objection on draft-ietf-cose-cwt-claims-in-headers-09: (with COMMENT)

Michael Richardson <mcr+ietf@sandelman.ca> Wed, 29 November 2023 13:57 UTC

Return-Path: <mcr+ietf@sandelman.ca>
X-Original-To: cose@ietfa.amsl.com
Delivered-To: cose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B5A4C14CE4B; Wed, 29 Nov 2023 05:57:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.107
X-Spam-Level:
X-Spam-Status: No, score=-2.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sandelman.ca
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d2enMrRX011B; Wed, 29 Nov 2023 05:57:37 -0800 (PST)
Received: from relay.sandelman.ca (relay.cooperix.net [176.58.120.209]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A422C14CE27; Wed, 29 Nov 2023 05:57:36 -0800 (PST)
Received: from dyas.sandelman.ca (unknown [IPv6:2001:67c:64:42:a149:e570:55cd:54f5]) by relay.sandelman.ca (Postfix) with ESMTPS id C58871F4A5; Wed, 29 Nov 2023 13:57:33 +0000 (UTC)
Authentication-Results: relay.sandelman.ca; dkim=pass (2048-bit key; secure) header.d=sandelman.ca header.i=@sandelman.ca header.b="k9Hacgdb"; dkim-atps=neutral
Received: by dyas.sandelman.ca (Postfix, from userid 1000) id 6669FA0EA1; Wed, 29 Nov 2023 14:57:29 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=sandelman.ca; s=dyas; t=1701266249; bh=oJ2qjRxkzNAW80+SCx7OhM4ugQB/ttr7E9O2mUxAmZc=; h=From:To:cc:Subject:In-reply-to:References:Date:From; b=k9HacgdbdQ5o09NwFRwYJeQEzo4qCTSyiPrsq8V7JZMpeNAf32E53uQFbW1M9f1ft 7mdPNnTEE6umeYrONWUN3iFiTRvjaPTDVjTacsnJFB5KjfIEuTa7QujDCQhNFGfEJO uXQmLG/cjH96PHrrwgSeqrVs9ULUk9xKPVzR7OP6LeChHZao1ANL2IsT2vHXwN+xSb lN2CdQYbgTki/Spvri4QYM5hUebizKQxP5ohhVJepP6/IPCbtS28S3dSPAQU0Hl5R2 A8uQ2swwSDVmOZVzySbIhFI7AVH/s4yXMSLgRtELdtGydiDvnDAyDCp6LWkREOxxqF syS8aobttP55w==
Received: from dyas (localhost [127.0.0.1]) by dyas.sandelman.ca (Postfix) with ESMTP id 63825A05F3; Wed, 29 Nov 2023 14:57:29 +0100 (CET)
From: Michael Richardson <mcr+ietf@sandelman.ca>
To: Michael Jones <michael_b_jones@hotmail.com>
cc: =?iso-8859-1?Q?=C9ric_Vyncke?= <evyncke@cisco.com>, The IESG <iesg@ietf.org>, "draft-ietf-cose-cwt-claims-in-headers@ietf.org" <draft-ietf-cose-cwt-claims-in-headers@ietf.org>, "cose-chairs@ietf.org" <cose-chairs@ietf.org>, "cose@ietf.org" <cose@ietf.org>, "mprorock@mesur.io" <mprorock@mesur.io>, "orie@transmute.industries" <orie@transmute.industries>, "Hannes.Tschofenig@gmx.net" <Hannes.Tschofenig@gmx.net>
In-reply-to: <SJ0PR02MB7439576F3E3CA2042225DA5DB7BCA@SJ0PR02MB7439.namprd02.prod.outlook.com>
References: <170107973192.33027.13442282570620667585@ietfa.amsl.com> <SJ0PR02MB7439576F3E3CA2042225DA5DB7BCA@SJ0PR02MB7439.namprd02.prod.outlook.com>
Comments: In-reply-to Michael Jones <michael_b_jones@hotmail.com> message dated "Tue, 28 Nov 2023 21:36:11 +0000."
X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.3
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha512"; protocol="application/pgp-signature"
Date: Wed, 29 Nov 2023 14:57:29 +0100
Message-ID: <600298.1701266249@dyas>
Archived-At: <https://mailarchive.ietf.org/arch/msg/cose/tcAmB09o1fn3U-0tQ4aAa9bUOuU>
Subject: Re: [COSE] Éric Vyncke's No Objection on draft-ietf-cose-cwt-claims-in-headers-09: (with COMMENT)
X-BeenThere: cose@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: CBOR Object Signing and Encryption <cose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/cose>, <mailto:cose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cose/>
List-Post: <mailto:cose@ietf.org>
List-Help: <mailto:cose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/cose>, <mailto:cose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Nov 2023 13:57:42 -0000

Michael Jones <michael_b_jones@hotmail.com> wrote:
    > is only used to impose normative requirements in the main body of the
    > specification and not in the Privacy Considerations or Security
    > Considerations, which are just that: things to consider - not normative
    > requirements.

I also think it's bad form to make implementers find the MUSTs in the
considerations.  They should be in the main body, and just referred to in the
Considerations.
   "Because we do XYZ (Section ABC), we are therefore immune to attacks my giant spiders"


--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
 -= IPv6 IoT consulting =-                      *I*LIKE*TRAINS*

v2.23.0 | Report a Bug | By Email