Re: [Gen-art] [OAUTH-WG] Genart last call review of draft-ietf-oauth-token-exchange-14

Jari, thanks for your review. Brian, thanks for your response. I flagged the issue Jari raises below in my DISCUSS ballot — it’s not clear to me why there aren’t normative requirements around confidentiality as there are in the JWT spec and the OAuth 2.0 spec.

Thanks,
Alissa

> On Aug 10, 2018, at 3:49 PM, Brian Campbell <bcampbell=40pingidentity.com@dmarc.ietf.org> wrote:
> 
> Thanks for the review Jari,
> 
> Regarding minimizing details, I'm thinking that incorporating some text along the lines of what's in the Privacy Considerations of RFC 7523 <https://tools.ietf.org/html/rfc7523#section-7> might be a worthwhile addition.  
> 
> 
> On Fri, Aug 3, 2018 at 7:49 AM Jari Arkko <jari.arkko@piuha.net <mailto:jari.arkko@piuha.net>> wrote:
> Reviewer: Jari Arkko
> Review result: Ready
> 
> I am the assigned Gen-ART reviewer for this draft. The General Area
> Review Team (Gen-ART) reviews all IETF documents being processed
> by the IESG for the IETF Chair.  Please treat these comments just
> like any other last call comments.
> 
> For more information, please see the FAQ at
> 
> <https://trac.ietf.org/trac/gen/wiki/GenArtfaq <https://trac.ietf.org/trac/gen/wiki/GenArtfaq>>.
> 
> Document: draft-ietf-oauth-token-exchange-14
> Reviewer: Jari Arkko
> Review Date: 2018-08-03
> IETF LC End Date: 2018-08-06
> IESG Telechat date: Not scheduled for a telechat
> 
> Summary:
> 
> This specification describes a standardised protocol for requesting and
> receiving security tokens from an OAuth 2.0 authorisation service.
> 
> I had no experience on OAuth previously, but the document was understandable
> and as far as I could determine, had no major issues.
> 
> It was a bit more difficult to determine completeness.  Security and privacy
> considerations sections were quite short, for instance, and maybe that's
> justifiable given the ability to refer to prior RFCs on this subject. However,
> I suspect one could say more, e.g., Section 7 says "Tokens typically carry
> personal information and their usage in Token Exchange may  reveal details of
> the target services being accessed", but it does not offer any advice on how
> such details might be minimised. But perhaps that's already in another RFC as
> well.
> 
> Major issues:
> 
> Minor issues:
> 
> Nits/editorial comments:
> 
> 
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org <mailto:OAuth@ietf.org>
> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
> 
> CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited..  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you._______________________________________________
> Gen-art mailing list
> Gen-art@ietf.org
> https://www.ietf.org/mailman/listinfo/gen-art