Re: [saag] Input for conflict review of draft-secure-cookie-session-protocol

[Willy Tarreau <[e-mail]>]

On Thu, Oct 18, 2012 at 01:22:38PM -0400, Barry Leiba wrote:
> > Well, maybe it's a matter of point of view. Adam took great care to
> > rework the cookie spec and achieve RFC6265 with a number of usage
> > recommendations to use cookies in the safest way. Since this draft
> > suggests a usage which seems totally insecure to me, I found it
> > appropriate to raise it as conflicting with the intended use of
> > cookies. Maybe I was wrong, and if so please accept my apologises.
> > Then it's unclear to me what kind of conflict should be raised :-/
> 
> True, and it's sometimes unclear to us as well.

OK that makes me feel more comfortable now :-)

> I'll see your :-/ and raise you a :-(
> 
> What we're looking for is this sort of thing:
> - Is this document in direct conflict with current work in a working
> group?  Which one(s)?
> - Should this be handled by an existing working group?  Which one?
> - Should a new working group be chartered for this, rather than doing
> it as an Independent Submission?
> - Does it appear that the authors are trying to get around the system
> by submitting this to the ISE?
> - Is this spec proposing something sufficiently harmful that it needs
> proper IETF review to fix it?
> 
> I suppose your comments could be arguing for that last one.

Yes, seems appropriate.

> But look at the list in RFC 5742, Section 3, and comment here on which
> of the five responses you think applies to this document.

I'm balanced between 3 and 5 :
  3. The IESG has concluded that publication could potentially disrupt
     the IETF work done in WG <X> and recommends not publishing the
     document at this time.

  5. The IESG has concluded that this document extends an IETF protocol
     in a way that requires IETF review and should therefore not be
     published without IETF review and IESG approval.

Basically if used as general purpose cookies, the impossibility to ensure
non-replay would be a no-go for me as it goes against the principles of
RFC6265, hence #3.

However, if designed for use in very specific cases I'm not aware of, then
probably the document needs some editorial adjustments to clearly indicate
that it is not for general use and possibly be reviewed by specialists to
ensure nothing was left unchecked, hence #5.

> And then
> definitely give your other feedback on the document to the ISE and the
> document authors.

Done.

> Thanks, Willy.

You're welcome.

Cheers,
Willy