Re: [OAUTH-WG] AD Review of draft-ietf-oauth-spop-10

John Bradley <ve7jtb@ve7jtb.com> Sat, 16 May 2015 23:12 UTC

Return-Path: <ve7jtb@ve7jtb.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 506041A87E9 for <oauth@ietfa.amsl.com>; Sat, 16 May 2015 16:12:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.601
X-Spam-Level:
X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FBoGhaxZ6AMD for <oauth@ietfa.amsl.com>; Sat, 16 May 2015 16:12:36 -0700 (PDT)
Received: from mail-qc0-f176.google.com (mail-qc0-f176.google.com [209.85.216.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9790E1A87E7 for <oauth@ietf.org>; Sat, 16 May 2015 16:12:36 -0700 (PDT)
Received: by qcbgu10 with SMTP id gu10so73830454qcb.2 for <oauth@ietf.org>; Sat, 16 May 2015 16:12:35 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=PSfHCFNYkVduOWBYG7SMhIOhdRN2kARInsT2gquyK5c=; b=TIe2fkaGiAggc34SNzS6JvdxTSECA00v3XBDd/kXB8uI+WEpBCPs7XkNQsgQsxOx+5 lPlAGGhGWQsFwmGuUYK7tcO6LjAl/0vMGKt6QohniPVPGVoFSh7D1pnEw0Ftckp2ym53 jaDeiFGxXTROhbnvwu/EenJne71ZAzGQ5uchop6RHL4p6ESDKUaaN7i1BpvSia8pqUby WytNpLhM6pEznXmkfh21AhRowpVXanIwaXHWDHuL4/F1p13v8uiPotDZW/iniq8Vhc7b gJMt0Il2/MaBsdD1skUAiSnAfSvN5W44JgADjELzybhDD0hULSc13CnkIcoZ+f3Gcbmj cd7Q==
X-Gm-Message-State: ALoCoQnNm44TFON7dpoRC3bt71IpdCj2W6dMKBIfFoyc2mi9kRvz3cWGtB4uTn/dCdFszliy43Tt
X-Received: by 10.140.104.13 with SMTP id z13mr217113qge.76.1431817955836; Sat, 16 May 2015 16:12:35 -0700 (PDT)
Received: from [192.168.8.100] ([181.202.15.238]) by mx.google.com with ESMTPSA id u95sm3949978qge.16.2015.05.16.16.12.32 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sat, 16 May 2015 16:12:34 -0700 (PDT)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\))
From: John Bradley <ve7jtb@ve7jtb.com>
In-Reply-To: <CAHbuEH4rOsD-TXbL9_+6HrK3_tpoPrfKVLqcJ4f0k1nFCFunMQ@mail.gmail.com>
Date: Sat, 16 May 2015 20:12:24 -0300
Content-Transfer-Encoding: quoted-printable
Message-Id: <89A5F51C-DE0E-4B8D-9D3B-6D1142A31859@ve7jtb.com>
References: <CAHbuEH4rOsD-TXbL9_+6HrK3_tpoPrfKVLqcJ4f0k1nFCFunMQ@mail.gmail.com>
To: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
X-Mailer: Apple Mail (2.2098)
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/Cu3fO_hzi4bOIJ7OMKF_pfNHDTg>
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] AD Review of draft-ietf-oauth-spop-10
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 16 May 2015 23:12:38 -0000

Hi Kathleen,

I have made the two edits and updated the draft.

John B.

> On Apr 18, 2015, at 12:39 PM, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> wrote:
> 
> Hello,
> 
> I just reviewed draft-ietf-oauth-spop-10 and am thinking more should be said about TLS 1.2 in the security recommendations.  I see that it is recommended through RFC6819 that just says: 
> 
>  Attacks can be mitigated by using transport-layer mechanisms such as
>    TLS [RFC5246].  A virtual private network (VPN), e.g., based on IPsec
>    VPNs [RFC4301], may be considered as well.
> 
> 
> And more has been said in recent publications.  Since this particular draft is addressing a threat exposed when TLS is not in use, the language from the last draft would be better, requiring at least TLS 1.2 and referring to the TLS BCP.
> 
> The only other point from my review is a nit:
> At the end of section 4.4, there should be quotes around both instances of "plain".
> 
> Once this has been addressed, we can start IETF last call.
> 
> Thank you!
> -- 
> 
> Best regards,
> Kathleen
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth