Re: [saag] Input for conflict review of draft-secure-cookie-session-protocol

[Mark Nottingham <[e-mail]>]

As far as I can tell, this document specifies some extensions to the Cookie / Set-Cookie (RFC6265), and/or "squats" on some pre-defined cookie names. It's hard to tell, both because of how the draft is written, and because I read it very quickly.

6265 doesn't define how it's to be extended very well (possibly because the underlying assumption is that extensions are VERY difficult to deploy). However, the precedent of an independent stream RFC defining such extensions, or worse "squatting" on the cookie name space (which is very widely used and thus very difficult to guarantee an absence of conflict) is concerning.

It seems to me that this *might* therefore conflict with the (previous) HTTPSTATE WG's work. 

Cheers,


On 18/10/2012, at 1:25 PM, Barry Leiba <[e-mail]> wrote:

> A document titled "Secure Cookie Sessions for HTTP" has been submitted
> to the Independent Stream Editor (ISE):
> http://datatracker.ietf.org/doc/draft-secure-cookie-session-protocol/
> 
> The IESG has been asked to review the document, as specified in RFC
> 5742, Section 3.  The Security and Applications Area Directors are
> looking for input for that review.  Please post any relevant comments
> to the Security Area list, <[e-mail]>, as soon as possible, and at
> least by 1 November 2012.
> 
> Note: Please do NOT post responses to any of these mailing lists.
> Respond only to <[e-mail]> (using the subject line of this
> message).
> 
> Please read RFC 5742, Section 3, and be aware that we are not looking
> for detailed comments on the document itself (see below).  We
> specifically need input on whether this document is in conflict with
> work that's being done in the IETF.  Look at the five possible
> responses specified in that section, and help us determine whether any
> of 2 through 5 applies.  Please be specific in your response.
> 
> In addition to this, we're sure that the authors and the ISE would
> appreciate comments about the document.  If you have those, you may
> send them directly to the authors at
> <[e-mail]>
> and to the ISE at <[e-mail]>.
> General discussion of the document on these lists or the saag list will
> likely not get to the authors or the ISE.
> 
> Barry Leiba, Applications AD
> 

--
Mark Nottingham   http://www.mnot.net/