Re: [saag] Input for conflict review of draft-secure-cookie-session-protocol

Hello,

after a brief review of the draft, I got quite a bit of headache with 
this draft.
Answers inline.

Tobias

On 18/10/12 18:22, Barry Leiba wrote:
>> Well, maybe it's a matter of point of view. Adam took great care to
>> rework the cookie spec and achieve RFC6265 with a number of usage
>> recommendations to use cookies in the safest way. Since this draft
>> suggests a usage which seems totally insecure to me, I found it
>> appropriate to raise it as conflicting with the intended use of
>> cookies. Maybe I was wrong, and if so please accept my apologises.
>> Then it's unclear to me what kind of conflict should be raised :-/
> True, and it's sometimes unclear to us as well.  I'll see your :-/ and
> raise you a :-(
>
> What we're looking for is this sort of thing:
> - Is this document in direct conflict with current work in a working
> group?  Which one(s)?
Not to my knowledge. (talking about websec)
But it may be in conflict with use cases for cookies.

> - Should this be handled by an existing working group?  Which one?
Yes. IMHO this is actually very dangerous stuff. The implied use 
case/proposal is to not store state on a server at all and store and 
trust it on the client only, which would be a major paradigm shift. And 
actually would go against many security recommendations I have given and 
received in the past.

> - Should a new working group be chartered for this, rather than doing
> it as an Independent Submission?
No. No new WG, but I think we should try to fit it into one of the 
existing working groups.
> - Does it appear that the authors are trying to get around the system
> by submitting this to the ISE?
> - Is this spec proposing something sufficiently harmful that it needs
> proper IETF review to fix it?
Yes. As explained above: In my view this can be playing with fire.
I believe such a paradigm deserves (and needs) IETF review.

>
> I suppose your comments could be arguing for that last one.
>
> But look at the list in RFC 5742, Section 3, and comment here on which
> of the five responses you think applies to this document.  And then
> definitely give your other feedback on the document to the ISE and the
> document authors.
>
> Thanks, Willy.
>
> Barry
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag