IETF Logo Mail Archive

Re: [Gen-art] [Ace] Genart last call review of draft-ietf-ace-oauth-params-06

Seitz Ludwig <ludwig.seitz@combitech.se> Mon, 23 December 2019 07:52 UTC

Return-Path: <ludwig.seitz@combitech.se>
X-Original-To: gen-art@ietfa.amsl.com
Delivered-To: gen-art@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8CBB7120074; Sun, 22 Dec 2019 23:52:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.198
X-Spam-Level:
X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6lDhWAiRVx7l; Sun, 22 Dec 2019 23:52:43 -0800 (PST)
Received: from weald2.air.saab.se (weald2.air.saab.se [136.163.212.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1A1A12004A; Sun, 22 Dec 2019 23:52:42 -0800 (PST)
Received: from mailhub2.air.saab.se ([136.163.213.5]) by weald2.air.saab.se (8.14.4/8.14.4) with ESMTP id xBN7qHsh025100 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Mon, 23 Dec 2019 08:52:17 +0100
Received: from corpappl16594.corp.saab.se (corpappl16594.corp.saab.se [10.12.12.126]) by mailhub2.air.saab.se (8.13.8/8.13.8) with ESMTP id xBN7q3fW013399 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 23 Dec 2019 08:52:03 +0100
Received: from corpappl16595.corp.saab.se (10.12.12.127) by corpappl16594.corp.saab.se (10.12.12.126) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1847.3; Mon, 23 Dec 2019 08:52:03 +0100
Received: from corpappl16595.corp.saab.se ([fe80::3c3e:6470:4c56:a86f]) by corpappl16595.corp.saab.se ([fe80::3c3e:6470:4c56:a86f%4]) with mapi id 15.01.1847.003; Mon, 23 Dec 2019 08:52:03 +0100
From: Seitz Ludwig <ludwig.seitz@combitech.se>
To: 'elwynd' <elwynd@folly.org.uk>, Ludwig Seitz <ludwig_seitz@gmx.de>, Elwyn Davies <elwynd@dial.pipex.com>, "gen-art@ietf.org" <gen-art@ietf.org>
CC: "last-call@ietf.org" <last-call@ietf.org>, "draft-ietf-ace-oauth-params.all@ietf.org" <draft-ietf-ace-oauth-params.all@ietf.org>, "ace@ietf.org" <ace@ietf.org>
Thread-Topic: [Gen-art] [Ace] Genart last call review of draft-ietf-ace-oauth-params-06
Thread-Index: AQHVuPcohBjIfZMHXEW74d/seKNoOKfHVcdA
Date: Mon, 23 Dec 2019 07:52:03 +0000
Message-ID: <343e0d4096cf4bb782cccf10176748f1@combitech.se>
References: <60524620-542b-293d-d954-7c7ecb45bde1@gmx.de> <E1ij5wt-0004Yd-1F@b-painless.mh.aa.net.uk>
In-Reply-To: <E1ij5wt-0004Yd-1F@b-painless.mh.aa.net.uk>
Accept-Language: en-SE, sv-SE, en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.12.13.199]
Content-Type: multipart/alternative; boundary="_000_343e0d4096cf4bb782cccf10176748f1combitechse_"
MIME-Version: 1.0
X-Saab-MailScanner-Information: Please contact the ISP for more information
X-Saab-MailScanner-ID: xBN7q3fW013399
X-Saab-MailScanner: Found to be clean
X-Saab-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=0.502, required 5, ALL_TRUSTED -1.00, HTML_MESSAGE 0.00, KAM_NUMSUBJECT 0.50, SURBL_BLOCKED 1.00, URIBL_BLOCKED 0.00)
X-Saab-MailScanner-From: ludwig.seitz@combitech.se
X-Saab-MailScanner-Watermark: 1577692324.00995@vdOiiTCHW/Vc4xPoDziqPQ
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.6.2 (weald2.air.saab.se [136.163.212.4]); Mon, 23 Dec 2019 08:52:18 +0100 (CET)
Archived-At: <https://mailarchive.ietf.org/arch/msg/gen-art/1uDElQn6ndS4qcPnNS68UetdheQ>
X-Mailman-Approved-At: Fri, 03 Jan 2020 10:50:56 -0800
Subject: Re: [Gen-art] [Ace] Genart last call review of draft-ietf-ace-oauth-params-06
X-BeenThere: gen-art@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "GEN-ART: General Area Review Team" <gen-art.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/gen-art>, <mailto:gen-art-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/gen-art/>
List-Post: <mailto:gen-art@ietf.org>
List-Help: <mailto:gen-art-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/gen-art>, <mailto:gen-art-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 23 Dec 2019 07:57:57 -0000

Hello Elwyn,

Sorry for being a pain. I have one more comment.

/Ludwig (now finally from the corporate account)

From: elwynd <elwynd@folly.org.uk>
Sent: den 22 december 2019 19:27
To: Ludwig Seitz <ludwig_seitz@gmx.de>; Elwyn Davies <elwynd@dial.pipex.com>; gen-art@ietf.org
Cc: last-call@ietf.org; draft-ietf-ace-oauth-params.all@ietf.org; ace@ietf.org
Subject: Re: [Gen-art] [Ace] Genart last call review of draft-ietf-ace-oauth-params-06

Hi, Ludwig.

Having had another look at section 3.1 of draft-ietf-ace-cwt-proof-of-possession, technically the rules about which keys have to be present are not part of the syntax of the cnf claim.  The point can be covered by changing '"syntax of the 'cnf' claim"
to "syntax and semantics of the 'cnf' claim"
in each case.

[LS] Ok. Will do.

However, the second look threw up another point:  Figure 2 in s3.2 gives a Symetric key example  - I think this should use an Encrypted_COSE_Key (or Encrypted_COSE_Key0) as described in section 3.3 of draft-ietf-ace-cwt-proof-of-possession.

[LS] Figure 2 in 3.2 gives an example of a AS response to a client requesting an access token. As per the requirements from draft-ietf-ace-oauth-authz, this communication MUST be confidentiality protected, therefore it is unnecessary to additionally encrypt the COSE_Key.
The provisions in 3.3 of draft-ietf-ace-cwt-proof-of-possession are for access tokens in CWT format, containing a symmetric key, that are not encrypted themselves (i.e. only MAC:ed or signed).

Otherwise I think we are done.

Eventually we will get to Christmas!

[LS] I promise to leave it be over the holidays.

v2.23.0 | Report a Bug | By Email