Re: [Id-event] Alissa Cooper's No Objection on draft-ietf-secevent-token-11: (with COMMENT)

[Phil Hunt <[e-mail]>]

Alissa,

Your feedback is now posted in draft 12. 

Thanks again,

Phil

Oracle Corporation, Identity Cloud Services Architect
@independentid
www.independentid.com <http://www.independentid.com/>[e-mail] <mailto:[e-mail]>

> On May 9, 2018, at 12:30 PM, Alissa Cooper <[e-mail]> wrote:
> 
> Alissa Cooper has entered the following ballot position for
> draft-ietf-secevent-token-11: No Objection
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-secevent-token/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> = Sec. 5.1 =
> 
> "Security events distributed through third parties or that carry
>   personally identifiable information SHOULD be encrypted using JWE
>   [RFC7516] or secured for confidentiality by other means."
> 
> The SHOULD here seems like it should be a MUST unless there are obvious exception cases.
> 
> = Sec. 5.2 =
> 
> "In
>   addition to confidentiality and integrity (discussed above),
>   implementers and profiling specifications MUST consider the
>   consequences of delivery mechanisms that are not secure and/or not
>   assured."
> 
> The "implementers ... MUST consider" construction seems like an odd use of normative language.
> 
>