Re: [Id-event] Push Delivery: working group last call

[Mike Jones <[e-mail]>]

Having just finished editing the Poll spec, I’d like to add these points to my review of the Push spec.

5.2 TLS Support Considerations – Please change the sentence “In such cases, SET Transmitters and SET Recipients MUST require the use of a transport-layer security mechanism” to “In such cases, SET Transmitters and SET Recipients MUST encrypt the SET, either with a transport-layer security mechanism, with JWE <xref target="RFC7516"/>, or both”.  This will address my comment below and will match the corresponding text in draft-ietf-secevent-http-poll-02.

Acknowledgments – Delete the colon before draft-hunt-scim-notify-00 (matching a change to poll).

Acknowledgments – Change “the the SECEVENTS” to “the SecEvents” (matching a change to poll).

                                                       Thanks,
                                                       -- Mike

From: Mike Jones
Sent: Saturday, March 9, 2019 9:46 AM
To: 'Dick Hardt' <[e-mail]>; SecEvent <[e-mail]>
Cc: Yaron Sheffer <[e-mail]>; Annabelle Richard <[e-mail]>; Morteza Ansari (moransar) <[e-mail]>; Phil Hunt <[e-mail]>; Anthony Nadalin <[e-mail]>; Marius Scurtescu <[e-mail]>
Subject: RE: Push Delivery: working group last call

Here’s my review of draft-ietf-secevent-http-push-04.

Abstract – Delete the comma after “recipient”.

1.2 Definitions – Delete “as defined in [RFC8417]” as this was already cited in the introductory sentence.

1.2 Definitions – Delete entire “SET Recipient” definition, as this is already defined in RFC 8417.

2. SET Delivery – “SET Transmission Request” sounds like a defined term, but isn’t defined.  Please lowercase “transmission request”.

2. SET Delivery – Delete the comma after “acknowledging successful transmission of the SET”.

2. SET Delivery – Change “SET issuer” to “SET Issuer” in the fourth bullet (and wherever else it’s in lowercase).

2. SET Delivery – In “The mechanism for validating the authenticity of a SET is implementation specific” change “implementation specific” to “use case specific” or “deployment specific”, as it’s the use case that defines the validation rules – not the implementation.

2.1 Transmitting a SET – Change “may be implementation-specific” to “are use case specific”.

2.1 Transmitting a SET – Delete the second space in “POST /Events  HTTP/1.1”.

2.1 Transmitting a SET – Delete the signature value “c2lnbmF0dXJl” from the example JWT, since “alg”:”none” signatures must be empty.

2.2 Success Response – Delete the quotation marks around “acknowledge”.

3. Authentication and Authorization – Add a comma before “as per [RFC7235]”.

5.2 TLS Support Considerations.  Saying that a transport-layer security mechanism is REQUIRED when SETs contain PII is unnecessarily heavy-handed.  The SET could be JWE-encrypted, in which case the PII is already protected – so no transport-level security mechanism is needed in that case.  Please reword this to say that PII must be protected with encryption, either by using an encrypted SET or by using transport-level encryption.

7.1.1 Registration Template, Error Code – Please change the allowed characters to match those allowed in OAuth 2.0 “error” values.  See https://tools.ietf.org/html/rfc6749#appendix-A.7.

7.1.1 Registration Template, Change Controller – Change “Secevent” to “SecEvent”.

7.1.2 Initial Registry Contents, invalid_request – Delete the comma after “parsed as a SET”.

7.1.2 Initial Registry Contents, invalid_key – Delete the period between “SET Recipient” and “(e.g.” and add a period at the end of the description.

7.1.2 Initial Registry Contents, access_denied – Delete the word “provided”, as it is confusing and adds no actionable information.

Appendix A, Other Streaming Specifications – Add text saying that the working group is also defining the Poll transmission mechanism and reference draft-ietf-secevent-http-poll.  Perhaps include the description of this functionality from the abstract of the specification.

                                                       Thanks,
                                                       -- Mike

From: Dick Hardt <[e-mail]<mailto:[e-mail]>>
Sent: Thursday, January 24, 2019 10:11 AM
To: SecEvent <[e-mail]<mailto:[e-mail]>>
Cc: Yaron Sheffer <[e-mail]<mailto:[e-mail]>>; Annabelle Richard <[e-mail]<mailto:[e-mail]>>; Mike Jones <[e-mail]<mailto:[e-mail]>>; Morteza Ansari (moransar) <[e-mail]<mailto:[e-mail]>>; Phil Hunt <[e-mail]<mailto:[e-mail]>>; Anthony Nadalin <[e-mail]<mailto:[e-mail]>>; Marius Scurtescu <[e-mail]<mailto:[e-mail]>>
Subject: Push Delivery: working group last call

Dear SecEvent participants,

This is to start a 2-week working group last call on draft-ietf-secevent-http-push-04

https://datatracker.ietf.org/doc/draft-ietf-secevent-http-push/

until Feb 8, 2019.

Please send any comments to the list. In addition, if you have no comments but support publication of this document as-is, please make your voice heard.

Thanks,

     Dick and Yaron