Re: [Id-event] Benjamin Kaduk's Yes on draft-ietf-secevent-http-push-12: (with COMMENT)

[Mike Jones <[e-mail]>]

Thanks for your review, Ben.  https://tools.ietf.org/html/draft-ietf-secevent-http-push-13 is intended to address your comments.  Detailed replies are inline, prefixed by "Mike>".

-----Original Message-----
From: Benjamin Kaduk via Datatracker <[e-mail]> 
Sent: Tuesday, June 16, 2020 5:56 PM
To: The IESG <[e-mail]>
Cc: [e-mail]; [e-mail]; [e-mail]; Yaron Sheffer <[e-mail]>; [e-mail]
Subject: Benjamin Kaduk's Yes on draft-ietf-secevent-http-push-12: (with COMMENT)

Benjamin Kaduk has entered the following ballot position for
draft-ietf-secevent-http-push-12: Yes

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-secevent-http-push/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

We mention DNS-ID in the context of RFC 6125 validation in Section 5.3, but not in Section 3.  We don't necessarily need to mention it in both places, but it might be nice to be consistent or to remove some of the redundancy.

Mike> DNS-ID is now uniformly included in both drafts.

Section 6

I think both SET Issuers and Transmitters (not just one or the other) should consider the ramifications of sharing a particular SET.  While it's true that (as the secdir reviewer noted) when JWE is used the Issuer has sole knowledge/control, but in other cases the Issuer may not know the full recipient list.

Mike> Both are now called out.

Appendix A

(Some information leakage is possible even over the TLS channel, too.  Message padding algorithms to prevent such side channels remain an open research
topic.)

Mike> I described this in a note in the appendix.

To the IESG: note that Appenix B ("Other Streaming Specifications") is currently slated for removal prior to publication.

				Thanks again,
				-- Mike