[secdir] Secdir last call review of draft-ietf-webpush-vapid-03

Robert Sparks <rjsparks@nostrum.com> Wed, 28 June 2017 21:38 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: Robert Sparks <rjsparks@nostrum.com>
To: secdir@ietf.org
Cc: webpush@ietf.org, ietf@ietf.org, draft-ietf-webpush-vapid.all@ietf.org
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <149868592596.7659.3988919152591675113@ietfa.amsl.com>
Date: Wed, 28 Jun 2017 14:38:45 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/TGjYoT8kUI2obwfcRBwGvvGFH-I>
Subject: [secdir] Secdir last call review of draft-ietf-webpush-vapid-03

Reviewer: Robert Sparks
Review result: Has Nits

Summary: Ready (with nits)

This document provides a mechanism for an application server to voluntarily
identify itself to a push server using JWT. The draft is easy to follow. The
security properties of this mechanism are clearly and thoroughly discussed.

There are some minor nits:

1) The draft says that expiry claims MUST NOT be more than 24 hours from the
time of the request. Consider adding some discussion of why 24 hours was chosen
(vs some other arbitrary value), especially given the MUST NOT strength of the
requirement.

2) The last paragraph of 4.2 says application servers create subscriptions, but
it means to say that user agents do. Martin already addressed when I brought it
up out-of-band with <https://github.com/webpush-wg/webpush-vapid/pull/39/files>.

3) The last sentence of the abstract is missing a word. Perhaps s/subscription
a/subscription to a/ ?

4) Consider using the RFC8174 update to RFC2119.

[secdir] Secdir last call review of draft-ietf-we… Robert Sparks
Re: [secdir] Secdir last call review of draft-iet… Martin Thomson