[OAUTH-WG] Mirja Kühlewind's No Objection on draft-ietf-oauth-jwt-bcp-06: (with COMMENT)

[Mirja Kühlewind via Datatracker <[e-mail]>]

Mirja Kühlewind has entered the following ballot position for
draft-ietf-oauth-jwt-bcp-06: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-oauth-jwt-bcp/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I'm by far no expert here but I don't really understand all attacks described.
Maybe it's just me, however, especially 2.7 and 2.8 seem quite high level to me
and I'm wondering if it is possible to be more concrete or provide an example
or something. Anyway, the more important part is section 3, so no need to worry
too much about this.

I'm wondering if it would make sense for this document to update RFC7519. I
know there is no direct change but it complements RFC7519 and using the update
mechanism makes I easy/easier for readers of RFC7519 two find this doc.