Re: [secdir] Secdir last call review of draft-ietf-secevent-token-09

[Russ Housley <[e-mail]>]

The updated draft (-10) resolves my concern.

Thanks,
  Russ

> On Apr 20, 2018, at 2:03 PM, Russ Housley <[e-mail]> wrote:
> 
> Reviewer: Russ Housley
> Review result: Has Issues
> 
> I reviewed this document as part of the Security Directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the Security Area
> Directors.  Document authors, document editors, and WG chairs should
> treat these comments just like any other IETF Last Call comments.
> 
> Document: draft-ietf-secevent-token-09
> Reviewer: Russ Housley
> Review Date: 2018-04-20
> IETF LC End Date: unknown
> IESG Telechat date: 2018-05-10
> 
> Summary: Has Issues
> 
> Major Concerns
> 
> I do not understand the first paragraph of Section 3.  I made this
> comment on version -07, and some words were added, but I still do
> not understand this paragraph.  I think you are trying to impose some
> rules on future specifications that use SET to define events.  Let me
> ask a couple of questions that may help.  I understand that a
> profiling specification MUST specify the syntax and semantics for a
> collection of security event tokens, including the claims and payloads
> that are expected.  What MUST a profiling specification include?  What
> MUST a profiling specification NOT include?