Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02

Thanks for the detailed review, Annabelle, and for sitting down with me in person last week to go over it.  Proposed resolutions follow in-line.

From: Richard Backman, Annabelle [mailto:richanna@amazon.com]
Sent: Wednesday, August 2, 2017 11:43 AM
To: M.Lizar@OCG <m.lizar@openconsentgroup.com>; Mike Jones <Michael.Jones@microsoft.com>
Cc: Yaron Sheffer <yaronf.ietf@gmail.com>; SecEvent <id-event@ietf.org>
Subject: Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02

Thanks for all the work on this! It was my understanding that there was an open item from Prague regarding whether to explicitly declare the events’ profiling specification in the SET. Has this been discussed further, or do we still need to close on it?

I have several comments/questions on the current draft:

  1.  “Profile Specification” vs. “Profiling Specification”
There are a handful of instances of the former that need to be changed to the latter, to match the term as defined in section 1.2:
     *   In the “sub” definition in section 1.2
     *   In section 3
     *   In section 4.2

I think we should uniformly go with the term “Profiling Specification”, as you suggest.

  1.  Note regarding Subject Issuer vs. SET Issuer
The note regarding the potential for Subject and SET Issuer mismatch (in the “iss” definition in section 1.2) is I think more prescriptive than intended. As written, it mandates placing the Subject’s Issuer in an “iss” value within the event payload, but does not define a format or structure for this value. The logical format – that of the “iss” JWT claim – may or may not be appropriate, depending on the nature of the event and its Subject. I suggest removing this note and covering this concern elsewhere (see #4 below, re: Subject Identification).
(You were actually referring to Section 2.1.)  As we discussed, if the logical issuer for the SET doesn’t fit the JWT “iss” string syntax, it’s perfectly reasonable to define a different claim and its syntax that meets the application’s needs.  The “Note” part also doesn’t dictate that the “sub” claim name be used.  We could add the parenthetical remark “(either using the “iss” member name or another name)” before the first comma in the note, to make this point clear, if you think that would address your concern.

  1.  Explicit Typing of SETs
I suggest removing the text “if the SET could be used in an application context in which it could be confused with other kinds of JWTs” from the first paragraph of section 2.2, making the secevent+jwt typ header mandatory to implement for all SETs. This conditional is impossible to evaluate, as new types of JWTs will be introduced over time. Just considering existing JWTs, it is a lot to ask for Profiling Spec authors to fully examine the contents and usage of every existing JWT. Mandating use of typ for SETs takes this load off of Profiling Spec authors and insures that future specs have a consistent, reliable way to defend against JWT type confusion.
As we discussed, I’m reluctant to remove the clause because there is already this strong language at the end of the paragraph: “This MUST be included if the SET could be used in an application context in which it could be confused with other kinds of JWTs.”  So the default behavior is already the one you want.

  1.  Requirements for SET Profiles: Subject Identification
I suggest adding text along the lines of “Profiling Specifications MUST define for each of their events how the Subject is identified in the SET, as well as how to address conflicts the event Subject’s Issuer and the SET Issuer if applicable. It is NOT RECOMMENDED for Profiling Specifications to use the “sub” claim in cases where the Subject is not globally unique and has a different Issuer from the SET itself.”
I’m OK adding something along those lines.

  1.  Guidance for Signing SETs
The text in the last paragraph of section 4.1 is unclear to me. It seems to suggest that it is safe to send unsigned JWTs over a channel that lacks transport-layer security, so long as requests include a bearer token or use Basic Authentication. Am I misreading this? It seems counter to the guidance given earlier in the same section.
Good catch.  In fact the plain reading of the first half of the sentence is self-contradictory.  As we discussed, let’s simplify this to “Unless integrity of the JWT is ensured by other means, it MUST be signed using JWS…”

  1.  Distinguishing SETs from other kinds of JWTs
The last sentence of the first paragraph of section 4.7 seems impossible to me. Profiling Specifications cannot be solely responsible for ensuring incompatibility with all future JWT profiles. They can at best ensure incompatibility with existing JWT profiles and be compatible with a standard mechanism by which future JWT profiles may ensure incompatibility (e.g. the “secevent+jwt” typ header). It may be enough to strike the “(or other)” text from this sentence.
The second paragraph (beginning “The most direct way”) was written before we had explicit typing.  As we discussed, I propose to reorder paragraphs 2 and 3, changing explicit typing to be “The most direct way” and mutually exclusive validation logic to be “Another way”.  That puts the emphasis where it should be, at this juncture in the development of the specification.

--
Annabelle Richard Backman
Identity Services

                                                                Thanks again!
                                                                -- Mike

From: Id-event <id-event-bounces@ietf.org<mailto:id-event-bounces@ietf.org>> on behalf of "M.Lizar@OCG<mailto:M.Lizar@OCG>" <m.lizar@openconsentgroup.com<mailto:m.lizar@openconsentgroup.com>>
Date: Tuesday, August 1, 2017 at 9:17 AM
To: Mike Jones <Michael.Jones@microsoft.com<mailto:Michael.Jones@microsoft.com>>
Cc: Yaron Sheffer <yaronf.ietf@gmail.com<mailto:yaronf.ietf@gmail.com>>, SecEvent <id-event@ietf.org<mailto:id-event@ietf.org>>
Subject: Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02

+1 on existing text .

Agree the document is ready to publish

- Mark

On 31 Jul 2017, at 16:53, Mike Jones <Michael.Jones@microsoft.com<mailto:Michael.Jones@microsoft.com>> wrote:

I believe that the specification is ready to publish as-is.  It already meets the needs of the known use cases and is in production use.

                                                                -- Mike

From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Yaron Sheffer
Sent: Monday, July 31, 2017 1:40 PM
To: SecEvent <id-event@ietf.org<mailto:id-event@ietf.org>>
Subject: [Id-event] WG Last Call for draft-ietf-secevent-token-02

This is to announce working group last call on this draft (https://datatracker.ietf.org/doc/draft-ietf-secevent-token/).

Please send your comments to the list. Even if you are perfectly happy with the draft, please let us know that you support its publication as-is by posting to the list.

Because of the summer holidays, this last call is open for 3 weeks, until Aug. 21.

Thanks,
    Dick and Yaron
_______________________________________________
Id-event mailing list
Id-event@ietf.org<mailto:Id-event@ietf.org>
https://www.ietf.org/mailman/listinfo/id-event