Re: [Gen-art] [Id-event] Genart last call review of draft-ietf-secevent-http-poll-09
Mike Jones <Michael.Jones@microsoft.com> Thu, 04 June 2020 21:27 UTC
Return-Path: <Michael.Jones@microsoft.com>
X-Original-To: gen-art@ietfa.amsl.com
Delivered-To: gen-art@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52BBC3A0F70; Thu, 4 Jun 2020 14:27:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.101
X-Spam-Level:
X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EQ4kT7YVzZ7v; Thu, 4 Jun 2020 14:27:42 -0700 (PDT)
Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640119.outbound.protection.outlook.com [40.107.64.119]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC1553A0F6B; Thu, 4 Jun 2020 14:27:39 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=AdiLZKHqTZa4xj7RQjQKUzn/il6Lry0fqP8yQvAHfyOB1h2CzdxZaqUhqwvqJak4pDz6gzxnr5piM+FeMupRxR1WaI0bA5cda8JH38KXgbm9CXr8oAvujNt5ChYWtT3uvQa5JuSuE6F79T/+OF2UfQLJaOxYFEkvDrNCwpJYo8+ryTP4Fg0mNpbdxh42Hwz0jTuwyIX3gpXU79fVuNg1hSUzamT9p8UhGKtIK0w4TtF2DwWpS+UqBFuygGcB/Pl1+9HiMidvf7aLwb3BWW9DVUCe0hlq+vR/a0u2HI8PHioPDCTjLgkLHhoVNNO+73dcM9pKm38FN92/jN98BWJmRw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=i+d4O8JRwl7m7SpnAL5hEN5jB5jFJC+Y0WtG55ofzJ8=; b=SpaE+yn/iyp1JmxOEFEu5YgxJ492GRCXXKFoD+IKW+ADQrwD2Qd33+ABvxdoA+DlW2pNLr2Xoxn1p49IiMrhZ1E9gUlt5W/kTvfYjPQe9QPvh/Nq+bh/UMeLUTnR30O4kaYY4Hz4a4c0dKEYUvFaG9kE1vymin5KVDVvdSwtQrwMu8CphgLFxcKpGnHx4qqGy/jrhqPgb3v0U+HlEPfOMMw18Y/b9hS5M/rsxGx0R06/c4dQAYZsNdjAqFVlH0xXQY+YyBRD2TZWal5zv4LUVg0sVZaiGImJJvN0cQk4ISHfTPSKkFM4VfaXnd8RSV5d4k7/vE/7ZDnRTO6HaFr0Gg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=i+d4O8JRwl7m7SpnAL5hEN5jB5jFJC+Y0WtG55ofzJ8=; b=hGyC/q+2A0YHWJH6kxAoefL/HvepXmhp9FN9wB6xZyrnp8x+1GhJZF2oEP3XR4ndeqlEkhS1laGDsZXdZX04PPzmBDKSnT7tIM7/LI9Puf9s4rm+QsLhHpo1QNzALTMkFvQatVwVW9gSNtgkbuY3Il3OrZc8g22O2aaSq4A11zo=
Received: from CH2PR00MB0678.namprd00.prod.outlook.com (2603:10b6:610:a9::23) by CH2PR00MB0661.namprd00.prod.outlook.com (2603:10b6:610:ad::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3105.0; Thu, 4 Jun 2020 21:27:38 +0000
Received: from CH2PR00MB0678.namprd00.prod.outlook.com ([fe80::f158:8611:537b:9f84]) by CH2PR00MB0678.namprd00.prod.outlook.com ([fe80::f158:8611:537b:9f84%7]) with mapi id 15.20.3109.000; Thu, 4 Jun 2020 21:27:37 +0000
From: Mike Jones <Michael.Jones@microsoft.com>
To: Robert Sparks <rjsparks@nostrum.com>, "gen-art@ietf.org" <gen-art@ietf.org>
CC: "last-call@ietf.org" <last-call@ietf.org>, "draft-ietf-secevent-http-poll.all@ietf.org" <draft-ietf-secevent-http-poll.all@ietf.org>, "id-event@ietf.org" <id-event@ietf.org>
Thread-Topic: [Id-event] Genart last call review of draft-ietf-secevent-http-poll-09
Thread-Index: AdY6tvW5hk67JCjvSlibk8SCiuZX2g==
Date: Thu, 04 Jun 2020 21:27:37 +0000
Message-ID: <CH2PR00MB06783ED2F09385CA71C06A55F5890@CH2PR00MB0678.namprd00.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=15e1ee15-cec5-4163-b010-00005713174f; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-06-04T20:45:12Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47;
authentication-results: nostrum.com; dkim=none (message not signed) header.d=none;nostrum.com; dmarc=none action=none header.from=microsoft.com;
x-originating-ip: [50.47.87.252]
x-ms-publictraffictype: Email
x-ms-office365-filtering-ht: Tenant
x-ms-office365-filtering-correlation-id: 47f4eb10-70d1-4cf3-d2ad-08d808ce1ad4
x-ms-traffictypediagnostic: CH2PR00MB0661:
x-microsoft-antispam-prvs: <CH2PR00MB0661BCAE98314982EF3C19DCF5890@CH2PR00MB0661.namprd00.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-forefront-prvs: 04244E0DC5
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: azzBvnUnBhzizkgyQ1aq6BWCQn/TJsYR/qWfYNeDD0E9/Vvnm1zL7hBqNrfB639a+cAtdVIjDxpx2Ac+3WUcgFConzO/oSCE/N4kqLMLTUPzhl2K8wawwlZza5JjjlQLPOQ6O3Z/b24wYNLEOS7n23xA3CGrzd/9NkFqKW6aphVfSGl/loWRotAZ7RU4RuoKFqv82SqV8EvqfnxceaJLkugMNMOEV2ZxcTQh6vR/BhJalN8GSe7nucjd477az3089DTo2W6pwS/pMNnxF4krIJzRIZkCVuRqhB8j/LUxAtyGBGvKLUFKoDealfpSYGlgj12wUpYS5Gz2IgMbsSB0iQ/SBOG2iCGXmTU991ooFErgkD2OX7ctqCXWXUT0PjRLLvJ2uGEAs0giowq5EIkDDQ==
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR00MB0678.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(346002)(396003)(136003)(39860400002)(376002)(6506007)(55016002)(8936002)(8676002)(53546011)(66476007)(26005)(5660300002)(66446008)(64756008)(2906002)(9686003)(76116006)(71200400001)(110136005)(316002)(66946007)(54906003)(7696005)(66556008)(8990500004)(10290500003)(4326008)(186003)(52536014)(33656002)(83380400001)(478600001)(86362001)(966005)(82950400001)(82960400001); DIR:OUT; SFP:1102;
x-ms-exchange-antispam-messagedata: HstthElfdOPqI/z2Na0qsMw8krL22h3QNthLVpnfbCJ1xaGY7uCzDwQsDdtHU6UrSiw3WHyEt8OdlTO9m/jHKQcU7gGgSJD0pAZW8x0GP38hl/t8K9dxzqNW/oocoDDnbtEUFac2ZQ7pTZu3+8Gbm9CRnG859xh3H01c1zT4IjJAwbHML0Zf0OcNTSSbYfR/9kGofAcjOiGJTu1BjCnbgCK1dxKjJjg/lVgRnJypR/35Y+WVusEkcxnW1IzEUraRqSah/dWg1bJIw4aCsQl/LjBQqVaG35CLvP7gaflF5gZN7X9KRChc07Fx0QrqkmwGWabcxHHi1MA0tiecC2EQshXXdxAobLPSHCnOVxc5sKTLbEktO6Woc1MuHFW/faIn1OCZXf0yFI4y1HtYgnw7a30MZzLEG7Am8rT4TQjGCpR4L6xl6GYTQmTk+PxsNnTf9Zi9zvmaGOimkFD+hHd9KoElaKyMvPyna4QWcRTZstU=
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 47f4eb10-70d1-4cf3-d2ad-08d808ce1ad4
X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Jun 2020 21:27:37.7802 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: qInpEEE+WXwO9/OUyY2JuLEjG93G2MXWab42WYYqGkjsh0OPJtw0YKeKW8DgdEswB2ob9Hu9y/df1R4ldZjPWg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR00MB0661
Archived-At: <https://mailarchive.ietf.org/arch/msg/gen-art/t1rQIXGnHLNvXzgjx-yjVxaILA4>
Subject: Re: [Gen-art] [Id-event] Genart last call review of draft-ietf-secevent-http-poll-09
X-BeenThere: gen-art@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "GEN-ART: General Area Review Team" <gen-art.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/gen-art>, <mailto:gen-art-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/gen-art/>
List-Post: <mailto:gen-art@ietf.org>
List-Help: <mailto:gen-art-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/gen-art>, <mailto:gen-art-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 04 Jun 2020 21:27:45 -0000
Thanks for your review, Robert. I'm working on addressing the review comments received and wanted to have a clarifying discussion on some of yours before deciding what corresponding edits to make. I think there's a misunderstanding about "jti" values and the security model. Because communication is over a TLS-protected channel between two parties, it would be fine if the JTI values were totally guessable, such as "A", "B", "C", etc. There's no opportunity for an attacker to inject traffic into or to listen to the stream. Does that make sense to you? As for limits on how long a transmitter is required to hold a SET, I propose to add this text: Transmitters may also discard undelivered SETs under deployment-specific conditions, such as if they have not been polled for over too long a period of time or if an excessive amount of storage is needed to retain them. -- Mike -----Original Message----- From: Id-event <id-event-bounces@ietf.org> On Behalf Of Robert Sparks via Datatracker Sent: Friday, May 8, 2020 11:57 AM To: gen-art@ietf.org Cc: last-call@ietf.org; draft-ietf-secevent-http-poll.all@ietf.org; id-event@ietf.org Subject: [Id-event] Genart last call review of draft-ietf-secevent-http-poll-09 Reviewer: Robert Sparks Review result: Ready with Issues I am the assigned Gen-ART reviewer for this draft. The General Area Review Team (Gen-ART) reviews all IETF documents being processed by the IESG for the IETF Chair. Please treat these comments just like any other last call comments. For more information, please see the FAQ at <https://trac.ietf.org/trac/gen/wiki/GenArtfaq>. Document: draft-ietf-secevent-http-poll-09 Reviewer: Robert Sparks Review Date: 2020-05-08 IETF LC End Date: 2020-05-13 IESG Telechat date: Not scheduled for a telechat Summary: Essentially ready but with some issues to consider before publishing as a Proposed Standard RFC This document is well-written and easy to follow. I have a couple of edge-case issues that I think should be considered though: This document allows, and anticipates, deployments where Recipients are not well authenticated. See, for example, the first sentence of section 4.1. There is also an unstated expectation in the document that the jti of each SET is hard to guess. If it's reasonably easy to guess jti values, a malicious Recipient could ack SETs it has never received and the Transmitter will remove that state, preventing a valid Recipient from ever receiving that SET. If that's an explicit requirement in the jwt or SET base documents for the jti to be hard to guess, please point me to it? If there's not, perhaps a short discussion in the security considerations requiring this property would be worthwhile? Is there a discussion somewhere of how long the transmitter is required to hold a given SET for a Recipient? Forever seems unreasonable. _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event
- [Gen-art] Genart last call review of draft-ietf-s… Robert Sparks via Datatracker
- Re: [Gen-art] [Id-event] Genart last call review … Mike Jones
- Re: [Gen-art] [Id-event] Genart last call review … Robert Sparks
- Re: [Gen-art] [Id-event] Genart last call review … Mike Jones
- Re: [Gen-art] [Id-event] Genart last call review … Yaron Sheffer
- Re: [Gen-art] [Id-event] Genart last call review … Mike Jones
- Re: [Gen-art] [Id-event] Genart last call review … Yaron Sheffer
- Re: [Gen-art] [Id-event] Genart last call review … Mike Jones
- Re: [Gen-art] [Id-event] Genart last call review … Dick Hardt
- Re: [Gen-art] [Id-event] Genart last call review … Richard Backman, Annabelle
- Re: [Gen-art] [Id-event] Genart last call review … Mike Jones
- Re: [Gen-art] [Id-event] Genart last call review … Phillip Hunt
- Re: [Gen-art] [Id-event] Genart last call review … Mike Jones