IETF Logo Mail Archive

Re: [saag] Input for conflict review of draft-secure-cookie-session-protocol

SM <sm@resistor.net> Thu, 18 October 2012 17:02 UTC

Return-Path: <sm@resistor.net>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 007F921F877D for <saag@ietfa.amsl.com>; Thu, 18 Oct 2012 10:02:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.587
X-Spam-Level:
X-Spam-Status: No, score=-102.587 tagged_above=-999 required=5 tests=[AWL=0.013, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id plPYev91h+JT for <saag@ietfa.amsl.com>; Thu, 18 Oct 2012 10:02:48 -0700 (PDT)
Received: from mx.ipv6.elandsys.com (mx.ipv6.elandsys.com [IPv6:2001:470:f329:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3290421F875C for <saag@ietf.org>; Thu, 18 Oct 2012 10:02:48 -0700 (PDT)
Received: from SUBMAN.resistor.net (IDENT:sm@localhost [127.0.0.1]) (authenticated bits=0) by mx.elandsys.com (8.14.5/8.14.5) with ESMTP id q9IH2InO004725; Thu, 18 Oct 2012 10:02:21 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=opendkim.org; s=mail2010; t=1350579743; bh=Wth8x54pHCQesSBuyX53TVsNaQSQkTDmyBhRGf36840=; h=Date:To:From:Subject:Cc:In-Reply-To:References; b=cKxVwrnENjNr/XpS4KPTkFyPca1VaFDlHvyVHI598ZEs8v4xM/32ds3vMYkS3S9H3 CeV2ZaGxbVahI0Pb51GUCNFJ1zUb/nvyfo1sk11vc93tN+O2MY0CiYnHNfBy+jJ2Ea ZhTOB51TNfwfipTe37UeO9ii+WrHbwBoHln/kAYY=
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=resistor.net; s=mail; t=1350579743; i=@resistor.net; bh=Wth8x54pHCQesSBuyX53TVsNaQSQkTDmyBhRGf36840=; h=Date:To:From:Subject:Cc:In-Reply-To:References; b=eLl7o+I8eqjdkI5fko3VtDxbhLTBX3Es3Z16k0FtLyrl9x+J2DnxHiWP/WRZT8Mzt 4JFILbVrVBuLnOTkSR6VzxpJnXejR9/pCpaWE0yL5/aWKrBkd3D6Odca3XDWmuT431 bCOSo0eosDdJYN08dEs9GqVqzsa7GQR0uXmIyIPc=
Message-Id: <6.2.5.6.2.20121018092011.0ab6fed0@resistor.net>
X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6
Date: Thu, 18 Oct 2012 09:37:35 -0700
To: Willy Tarreau <w@1wt.eu>
From: SM <sm@resistor.net>
In-Reply-To: <20121018064805.GI7517@1wt.eu>
References: <CALaySJK5JBo1cbsqcX6hyk0gSkDciZkX3o=o+rg9rgNVqBeRhw@mail.gmail.com> <20121018064805.GI7517@1wt.eu>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format="flowed"
Cc: saag@ietf.org
Subject: Re: [saag] Input for conflict review of draft-secure-cookie-session-protocol
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/saag>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 18 Oct 2012 17:02:49 -0000

Hi Willy,
At 23:48 17-10-2012, Willy Tarreau wrote:
>Hence, I'm failing to see what specific use case this protocol covers,
>however I see a risk that it is adopted by users who don't completely
>understand its security implications. The focus is clearly set on how
>the cookie contents are secured but not that much on what it should or
>should not be used for.

The draft is supposed to be published through in the Independent 
Submissions stream.  What that means is that the document won't be an 
IETF specification or IETF "standard".  The question was whether the 
document conflicts with existing IETF work as the publication of the 
document as a RFC might be blocked or a note might be added to it.

A conflict review does not get into whether a protocol is "good" or 
"bad".  It may be better to send the above comment to 
draft-secure-cookie-session-protocol.all@tools.ietf.org

Regards,
-sm

v2.23.0 | Report a Bug | By Email