Re: [stir] For the sake of implementers, please verify errata in a timely manner

[Marc Petit-Huguenin <[e-mail]>]

Thanks Jon.  Hopefully that's enough comments to have our chairs verify/hold/reject these errata.

On 4/14/21 8:12 AM, Peterson, Jon wrote:
> Hey Marc,
> 
> Just to give my own impressions...
> 
> 	1. https://urldefense.com/v3/__https://www.rfc-editor.org/errata/eid5390__;!!N14HnBHF!vB-riIssLbCue77ZKcQR5dQ9bLfLiUdeH7FpVBy5_W-tYbCEDX33sgxRwzNd2Y5CGLQ$
> 
> I agree that the potential attack vector is not limited to DTLS-SRTP as a use case,  but I'm not sure I consider this fix "errata." The statement in the 12.1 is not normative, and as far as I can tell is a true description of the behavior of the mechanism. The fact that the signature might also protect things other than DTLS-SRTP just isn't the subject of that sentence taken in isolation.
> 
> 	2. https://urldefense.com/v3/__https://www.rfc-editor.org/errata/eid5391__;!!N14HnBHF!vB-riIssLbCue77ZKcQR5dQ9bLfLiUdeH7FpVBy5_W-tYbCEDX33sgxRwzNdnkkFpis$
> 
> We definitely decided to do it this way, it wasn't an accident, and so I don't view this as an error. I can see the argument for stating explicitly that RFC 8224 overrides the text in RFC 7518 section 4.1.6 to remove any confusion, but I'm not sure that would make a difference for me as to what behavior I put in, were I implementing it. If you don't like the override, the text still lets you use the clock at the AS to generate an "iat" value.
> 
> 	3. https://urldefense.com/v3/__https://www.rfc-editor.org/errata/eid5715__;!!N14HnBHF!vB-riIssLbCue77ZKcQR5dQ9bLfLiUdeH7FpVBy5_W-tYbCEDX33sgxRwzNd6Z8MYnY$
> 
> I'm sure that the language could be cleaned up in both RFC8224 and RFC8225 here. Our use of "object" vs. "array" vs. just "value", or even "claim" or "element",  was definitely a bit sloppy, and they were the subject of some last-minute wordsmithing, which didn't lead to total alignment. That much said, I'm not entirely sure what bar to implementation would be removed by tightening all this up, and it would be an exercise to figure out exactly which parts to tighten. So I'm a little lukewarm on this one.
> 
> 	4. https://urldefense.com/v3/__https://www.rfc-editor.org/errata/eid6499__;!!N14HnBHF!vB-riIssLbCue77ZKcQR5dQ9bLfLiUdeH7FpVBy5_W-tYbCEDX33sgxRwzNdg4WYbn4$
> 
> That seems like actual errata to me. Fine by me to fix it.
> 
> 	5. https://urldefense.com/v3/__https://www.rfc-editor.org/errata/eid6519__;!!N14HnBHF!vB-riIssLbCue77ZKcQR5dQ9bLfLiUdeH7FpVBy5_W-tYbCEDX33sgxRwzNdWn4ubGw$
> 
> This one we're discussing elsewhere, but it looks good to me.
> 
> Jon Peterson
> Neustar, Inc.
> 


-- 
Marc Petit-Huguenin
Email: [e-mail]
Blog: https://marc.petit-huguenin.org
Profile: https://www.linkedin.com/in/petithug