[saag] Input for conflict review of draft-secure-cookie-session-protocol

[Thomas Fossati <[e-mail]>]

Hi Tobias,

>> - Should this be handled by an existing working group?  Which one?
> Yes.

A little bit of context, to hopefully give everyone the reasons why
and how we are here.

SCS was presented for the first time (to get expert review/feedback)
to IRTF CFRG in September 2006:

  http://www.ietf.org/mail-archive/web/cfrg/current/msg01307.html

Then after a long pause, I brought it to the IETF (http-state WG) in
February 2011:

  http://www.ietf.org/mail-archive/web/http-state/current/msg01227.html

where I've tried to propose it as a working group item, with no avail.
(Please note that this pre-dates JOSE BoF which was held in March 2011 IIRC.)

So, the natural outcome was to go through ISE, which I've done in December 2011.


In these years, in different occasions it has received extensive
review by a couple of well known and respected security guys -- David
Wagner and Jim Schaad.

The whole shebang is nothing new, just a simple bearer token format
which is suitable for use in HTTP (in cookies and URIs, or any other
HTTP header value).  With the added value that it can be traced back
to a provably secure authenticated encryption scheme.

I've taken the trouble to publish as I though it could provide a solid
and reusable building block for developers, that, as a bonus, are also
given a reference open-source implementation.

The Security Consideration has plenty of material about the possible
risks and related countermeasures / mitigations.  If there's something
that really needs to be said and it's not already there, please state
it precisely and I'll do the needed editing.

I like to hear solid technical comments, I really like it, and I'm
totally open to modify the I-D as long as the proposed modifications
makes it a better document.  This is the sole purpose of going through
the IETF process, after all.

Thanks, Thomas.