Re: [kitten] AD review of draft-ietf-kitten-sasl-oauth-21

[Benjamin Kaduk <[e-mail]>]

On Wed, 29 Apr 2015, Bill Mills wrote:

> Everything up to the concrete example works for me.  The example is
> vaporware, I'd rather use a concrete one or leave it out.

I think the SNI example is a concrete example, in that it is very clear
which values are to be compared.  The fact that it is not a comparison
which is performed by any extant software is a different issue.

To continue along those lines, we frequently publish specifications that
have not been (fully) implemented; I see our duty as to publish documents
that say what should be done for correct and secure (inter)operation.  I
recognize that not all checks are always implemeted everywhere, but that
does not free us of our obligation to write documents containing all the
security checks that we believe are relevant.  So, I believe that this
text is useful and correct, and do not see merit in the objection raised
thus far.

However, I am not particularly tied to this particular example, and if you
still wish to replace it with a different example (such as the one Stephen
mentioned off-list, of an IMAP server configured only to serve example.com
that should reject client response claiming to be for example.net), I can
accept that for the goal of moving the document forward.

-Ben