Re: [saag] [apps-discuss] Input for conflict review of draft-secure-cookie-session-protocol

Barry,

draft-secure-cookie-session-protocol-08 is fairly close to the IETF JOSE working group’s JSON Web Encryption (JWE) format [draft-ietf-jose-json-web-encryption].

jose@ietf.org was one group NOT included in your email asking for conflict review.

draft-secure-cookie-session-protocol-08:
* a smallish text string with confidentiality and integrity protection; as does JWE
* symmetric key; which is one JWE option
* arbitrary binary content; same as JWE
* uses base64url encoding; same as JWE
* uses "|" as a separator; JWE uses "."
* deflate compression; same as JWE
* includes the time; signing-time field has been proposed for JWE
* single id indicates keys and algorithms; JWE has separate alg id, and (broken) key id
* 

As to whether draft-secure-cookie-session-protocol-08 “could potentially disrupt the IETF work done in WG” JOSE… uhmm. Probably not.

--
James Manger

> -----Original Message-----
> From: apps-discuss-bounces@ietf.org [mailto:apps-discuss-
> bounces@ietf.org] On Behalf Of Barry Leiba
> Sent: Thursday, 18 October 2012 1:25 PM
> To: http-state@ietf.org; websec@ietf.org; ietf-http-wg@w3.org; apps-
> discuss@ietf.org; oauth@ietf.org
> Subject: [apps-discuss] Input for conflict review of draft-secure-
> cookie-session-protocol
> 
> A document titled "Secure Cookie Sessions for HTTP" has been submitted
> to the Independent Stream Editor (ISE):
> http://datatracker.ietf.org/doc/draft-secure-cookie-session-protocol/
> 
> The IESG has been asked to review the document, as specified in RFC
> 5742, Section 3.  The Security and Applications Area Directors are
> looking for input for that review.  Please post any relevant comments
> to the Security Area list, <saag@ietf.org>, as soon as possible, and at
> least by 1 November 2012.
> 
> Note: Please do NOT post responses to any of these mailing lists.
> Respond only to <saag@ietf.org> (using the subject line of this
> message).
> 
> Please read RFC 5742, Section 3, and be aware that we are not looking
> for detailed comments on the document itself (see below).  We
> specifically need input on whether this document is in conflict with
> work that's being done in the IETF.  Look at the five possible
> responses specified in that section, and help us determine whether any
> of 2 through 5 applies.  Please be specific in your response.
> 
> In addition to this, we're sure that the authors and the ISE would
> appreciate comments about the document.  If you have those, you may
> send them directly to the authors at <draft-secure-cookie-session-
> protocol@tools.ietf.org>
> and to the ISE at <rfc-ise@rfc-editor.org>.
> General discussion of the document on these lists or the saag list will
> likely not get to the authors or the ISE.
> 
> Barry Leiba, Applications AD
> _______________________________________________
> apps-discuss mailing list
> apps-discuss@ietf.org
> https://www.ietf.org/mailman/listinfo/apps-discuss