[OAUTH-WG] Fwd: Wording feedback in draft 3 of draft-ietf-oauth-v2-http-mac

Hannes Tschofenig <hannes.tschofenig@gmx.net> Tue, 07 May 2013 06:40 UTC

Message-ID: <5188A1CD.6010701@gmx.net>
Date: Tue, 07 May 2013 09:40:13 +0300
From: Hannes Tschofenig <hannes.tschofenig@gmx.net>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130329 Thunderbird/17.0.5
MIME-Version: 1.0
To: "oauth@ietf.org WG" <oauth@ietf.org>
References: <51884195.6010706@stanford.edu>
In-Reply-To: <51884195.6010706@stanford.edu>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Subject: [OAUTH-WG] Fwd: Wording feedback in draft 3 of draft-ietf-oauth-v2-http-mac
Precedence: list

Thanks for your feedback, Patrick.

I forwarded your review comments to the IETF OAuth mailing list. Will 
discuss it there.


-------- Original Message --------
Subject: Wording feedback in draft 3
Resent-To: hannes.tschofenig@gmx.net, jricher@mitre.org, 
wmills@yahoo-inc.com
Date: Mon, 06 May 2013 16:49:41 -0700
From: Patrick Radtke <pradtke@stanford.edu>
To: draft-ietf-oauth-v2-http-mac@tools.ietf.org

I'm not sure how this is usually done, but here is some feedback on
wording that I found confusing. I didn't know where to look to determine
if this feedback has already been given.


> 128	   Since a keyed message digest only provides integrity protection and
> 129	   data-origin authentication confidentiality protection can only be
> 130	   added by the usage of Transport Layer Security (TLS).

What is the 'since' implying? Usually 'since' would be used to imply an
action, but the rest of the sentence is just a statement. Maybe
"Transport Layer Security (TLS) MAY be used to provide data-origin
authentication confidentiality protection since a keyed message digest
only provides integrity protection"


> 323	   The transport of the mac_key from the authorization server to the
> 324	   resource server is accomplished by conveying the encrypting mac_key
> 325	   inside the access token.

The phrase 'encrypting mac_key' is confusing, maybe because its a typo?
Is that suppose to be 'encrypted mac_key' or 'conveying the mac_key
inside the encrypted access token'?

> 591	       the token).  The content of the access token, in particular the
> 592	       audience field and the scope, MUST be verified as described in

There is no reference after 'in'.


-Patrick

[OAUTH-WG] Fwd: Wording feedback in draft 3 of dr… Hannes Tschofenig