Subject: Re: [secdir] SECDIR review of draft-ietf-oauth-proof-of-possession-07
From: Mike Jones <[email-masked]>
To: Chris Lonvick <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Thu, 17 Dec 2015 15:07:51 +0000
List-Id: Security Area Directorate <secdir.ietf.org>

Sorry for the slow response, Chris.  Your note had been auto-sorted into my Clutter folder where I didn't see it.  Stephen helpfully pointed out that he hadn't seen a response.  Responses inline below...

> -----Original Message-----
> From: Chris Lonvick [mailto:[email-masked]] 
> Sent: Thursday, December 10, 2015 1:58 AM
> To: [email-masked]; [email-masked]; [email-masked]
> Subject: Re: SECDIR review of draft-ietf-oauth-proof-of-possession-07
>
> Shoot! I cut-n-pasted an incorrect email address yesterday. Resending to get this to the authors and everyone. Sorry for the dup's to some people.
> Best regards,
> Chris
>
> On 12/8/15 7:11 PM, Chris Lonvick wrote:
> Hi,
>
> I have reviewed this document as part of the security directorate's 
> ongoing effort to review all IETF documents being processed by the 
> IESG. These comments were written primarily for the benefit of the 
> security area directors. Document editors and WG chairs should treat 
> these comments just like any other last call comments.
>
> Overall, the document looks pretty good.
>
> I'd  recommend taking another look at the Security Considerations 
> section. It is sufficient and contains everything that I think needs 
> to be said. However, it may be a bit more clear if you separate the 
> security concerns of the protocol, from the security concerns of 
> credential management and policy. As I see it, the first and last 
> paragraphs are concerned with credentials and policy while the middle 
> paragraphs have statements about the actual protocol.

Fair enough.  I can group the security considerations items as you suggest.

> As a nit, I would suggest defining PoP at some point. While it's 
> pretty obvious, I just like the traditional use of defining it before 
> it's used.  :-)

I agree with this tradition. :-)

> Best regards,
> Chris

				Best wishes,
				-- Mike