Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10

[Dave Crocker <[e-mail]>]

On 8/9/2016 1:02 PM, Richard Shockey wrote:
> Third, Dave’s objections here are fundamental. He is rejecting the
> entire JWT construct in 4474bis that has been put forward.  It is
> almost inconceivable to me that at this late stage he is essentially
> asking us to issue a ‘full stop” and start over in favor of DKIM
> based construct or whatever.


Rich,

Yes, late-stage concerns are always discomfiting.  But I'll again note 
that that I did not raise a concern about JWT/JSON in my Passport 
review.  And I raised concern about it in my 4474bis review only after 
trying to work through the actual use, within the context of these 
specifications.

What I found was considerable additional reading and technical 
complexity, with no immediate benefit for the task at hand.  So while 
the model is appealing, it actually seems to be a net negative, in this 
case.

I believe I also found serious errors, resulting from the complexity, 
but this is an example of one of those items in the review that need 
public response and discussion.  So I await clarifications that make 
clear that I misread the document...

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net