[secdir] Secdir last call review of draft-ietf-ace-cbor-web-token-12
Kyle Rose <krose@krose.org> Fri, 02 March 2018 18:16 UTC
Return-Path: <krose@krose.org>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44B7712E8DF for <secdir@ietfa.amsl.com>; Fri, 2 Mar 2018 10:16:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.7
X-Spam-Level:
X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=krose.org
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id htkcQ9ZzMBbl for <secdir@ietfa.amsl.com>; Fri, 2 Mar 2018 10:16:55 -0800 (PST)
Received: from mail-qk0-x22c.google.com (mail-qk0-x22c.google.com [IPv6:2607:f8b0:400d:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3CC5012E892 for <secdir@ietf.org>; Fri, 2 Mar 2018 10:16:21 -0800 (PST)
Received: by mail-qk0-x22c.google.com with SMTP id y137so13045883qka.4 for <secdir@ietf.org>; Fri, 02 Mar 2018 10:16:21 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=krose.org; s=google; h=mime-version:from:date:message-id:subject:to; bh=rmrJXY3UjPDWlo6KTStRWPBo+LO3Uo4ZYqg2gNMzdI8=; b=JFndGGyqGkuUMdo6jhOMcanXxJQS6HMaYDhwwrw4SKTW1HkW7rh1HAtCpmkzMYBpg4 uKJNdljIcYs5LYvHOp5RXvaMLyC9F3uqRdha/syu4hgBrM+svqrXl76VQuPmTMI8l+Fu iRztMEKdpdjfryUVEBQtsEH0FSv7aIpRC7xZI=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=rmrJXY3UjPDWlo6KTStRWPBo+LO3Uo4ZYqg2gNMzdI8=; b=mp2h4Z+YBLw6kltaTo0XQJ0D4mHFQ1DHUyaygNUVUXIZrq/6j9mL1LiJaAkCEbBZNr zzZ5eQjx5coNn2WdgO+1MQZhyUJ59UjgJbxdKNseGYNQ1dkYxs+CURoOV/2/bfn3sCd+ zc132Uu3XTu/cn+cjkWV/qJEsoP6GawJ22tZczdE6yk7uVW1h8gdNY4cQMMah37DaztZ x5SYABeBvY0z3Dum7osxM6c1+ZwoQ+MFfl5zVNdDz2mKKxjuozMNhyMKQEevBmvy8dMB SrYw2bgQLDICrJHxhE8PDTJ7l7lAerH7TTP9+Py7GhgkO4UmqxP8390TWK705lNGxzUo nJbw==
X-Gm-Message-State: AElRT7H+4/jZiVeJsA3t+VoPB8oc7XQIFBZmEQWVQVnqNtvqQYGr4JKo foLghJySOp+uoxTLm+QPjkpPavEmgzBD3DDGZBR/qM7TpuZkwQ==
X-Google-Smtp-Source: AG47ELsB4cMbV+GabDjSkPxSK7M8pHmgS7mv8Ngvshn7E+VEu4BCNuBS8uZZeA3rwl6XhxHG/qGNBOAz572YwO6eXrI=
X-Received: by 10.55.27.18 with SMTP id b18mr9022888qkb.355.1520014580035; Fri, 02 Mar 2018 10:16:20 -0800 (PST)
MIME-Version: 1.0
Received: by 10.12.215.204 with HTTP; Fri, 2 Mar 2018 10:16:19 -0800 (PST)
X-Originating-IP: [2001:4878:a000:3000:6584:986b:3cfa:536b]
From: Kyle Rose <krose@krose.org>
Date: Fri, 02 Mar 2018 13:16:19 -0500
Message-ID: <CAJU8_nWatM=_reHiUMcshA0twHMSKrmgSkaorgtaOkbUb-1uuQ@mail.gmail.com>
To: secdir@ietf.org, The IESG <iesg@ietf.org>, draft-ietf-ace-cbor-web-token.all@ietf.org
Content-Type: multipart/alternative; boundary="001a1147ed3618fb54056671f913"
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/yVFGEMjFlY09rQ5YuziE1QZbiAI>
Subject: [secdir] Secdir last call review of draft-ietf-ace-cbor-web-token-12
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 02 Mar 2018 18:17:08 -0000
Reviewer: Kyle Rose Review result: Ready with nits I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This draft specifies a means for representing claims in CBOR, and for using COSE to encrypt and authenticate such claims. The listed security considerations seem to cover the same ground as the respective slices of the corresponding JWT references: the COSE RFC 8152 covers issues of trust establishment, as well as the vagaries of signature algorithms and key reuse, in more depth. My only nit for this document is the repeated use of the phrasing "...has the same meaning, syntax, and processing rules as..." throughout section 3.1: specifically, the inclusion of "syntax". For example, it doesn't seem to make sense to talk about the syntax of a CBOR NumericDate being the same as, or different from, the syntax of a JSON NumericDate: clearly, the binary representation is different, and it's not at all clear that it makes sense to talk about the human-readable source representation in this context. That said, there is some parallelism with respect to StringOrURI, as presumably the intent is to require that all strings containing a colon also be valid URIs.
- [secdir] Secdir last call review of draft-ietf-ac… Kyle Rose
- Re: [secdir] Secdir last call review of draft-iet… Kathleen Moriarty
- Re: [secdir] Secdir last call review of draft-iet… Mike Jones
- Re: [secdir] Secdir last call review of draft-iet… Mike Jones
- Re: [secdir] Secdir last call review of draft-iet… Kyle Rose