[secdir] secdir review of draft-ietf-oauth-revocation-07

Tom Yu <tlyu@MIT.EDU> Tue, 30 April 2013 05:11 UTC

Return-Path: <tlyu@mit.edu>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A3D9D21F99E4; Mon, 29 Apr 2013 22:11:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.599
X-Spam-Level:
X-Spam-Status: No, score=-103.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ApqjQ280JoZ1; Mon, 29 Apr 2013 22:11:51 -0700 (PDT)
Received: from dmz-mailsec-scanner-5.mit.edu (DMZ-MAILSEC-SCANNER-5.MIT.EDU [18.7.68.34]) by ietfa.amsl.com (Postfix) with ESMTP id 7245921F99DB; Mon, 29 Apr 2013 22:11:50 -0700 (PDT)
X-AuditID: 12074422-b7f5b6d00000095d-d9-517f5295b925
Received: from mailhub-auth-1.mit.edu ( [18.9.21.35]) by dmz-mailsec-scanner-5.mit.edu (Symantec Messaging Gateway) with SMTP id 3D.2A.02397.5925F715; Tue, 30 Apr 2013 01:11:49 -0400 (EDT)
Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-1.mit.edu (8.13.8/8.9.2) with ESMTP id r3U5Bm4J002161; Tue, 30 Apr 2013 01:11:49 -0400
Received: from cathode-dark-space.mit.edu (CATHODE-DARK-SPACE.MIT.EDU [18.18.1.96]) (authenticated bits=56) (User authenticated as tlyu@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id r3U5Bjhd016446 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 30 Apr 2013 01:11:47 -0400
Received: (from tlyu@localhost) by cathode-dark-space.mit.edu (8.12.9.20060308) id r3U5Bikl001454; Tue, 30 Apr 2013 01:11:44 -0400 (EDT)
To: iesg@ietf.org, secdir@ietf.org, draft-ietf-oauth-revocation.all@tools.ietf.org
From: Tom Yu <tlyu@MIT.EDU>
Date: Tue, 30 Apr 2013 01:11:44 -0400
Message-ID: <ldvtxmomwkv.fsf@cathode-dark-space.mit.edu>
Lines: 14
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrLIsWRmVeSWpSXmKPExsUixCmqrDs1qD7Q4MNtWYs5Hd+ZLGb8mchs 8WHhQxYHZo8lS34yeXy5/JktgCmKyyYlNSezLLVI3y6BK2P2i7fMBW9ZK2Y1LWNrYHzD0sXI ySEhYCJx4PkPNghbTOLCvfVANheHkMA+RonuvWuZIJyNjBJrpp1iBqkSEjjHJLFpQgBEootR YlL/FXaQhIhAtMTVr7/AbGEBC4nmc5OAujk42ASkJY4uLgMJswioSsydMgNsMy9QyfKtN1lB bB4BTon1/c8YIeKCEidnPgGrYRbQkrjx7yXTBEa+WUhSs5CkFjAyrWKUTcmt0s1NzMwpTk3W LU5OzMtLLdI11cvNLNFLTSndxAgKNXYXpR2MPw8qHWIU4GBU4uHdsaQuUIg1say4MvcQoyQH k5Iob4R3faAQX1J+SmVGYnFGfFFpTmrxIUYJDmYlEd5oR6Acb0piZVVqUT5MSpqDRUmc91rK TX8hgfTEktTs1NSC1CKYrAwHh5IE7/9AoEbBotT01Iq0zJwShDQTByfIcB6g4W9AaniLCxJz izPTIfKnGBWlxHkvgCQEQBIZpXlwvbBU8IpRHOgVYd67IFU8wDQC1/0KaDAT0OB5jdUgg0sS EVJSDYwFi48YrPC9JhR5c2vyo6Z9b7RMOiMf/jE4/mLprFN/bsb+tzrvwnDt6SrNjXI+yZXP XDfFryuZ0dxfnnaaw9TjeXejUvx+/taG+/KziuYyLM95/r6gREdyi5TIns0ro04VX7W+/3ji uq/u3E38G7g8csOs5x2NeTUzxdJU4PiZD/bz36/U2dyixFKckWioxVxUnAgAfzojTeACAAA=
Subject: [secdir] secdir review of draft-ietf-oauth-revocation-07
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 30 Apr 2013 05:11:57 -0000

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

I find the security considerations section of this document to be
mostly adequate.  It should probably mention the importance of
authenticating the endpoint (certificate validation etc.), especially
if the token is a bearer token.

Someone who is more familiar with the implications of cross-origin
issues should look at Section 2.3 to determine whether additional
security considerations need mentioning.