[GNAP] Re: Murray Kucherawy's No Objection on draft-ietf-gnap-resource-servers-09: (with COMMENT)

[Justin Richer <[e-mail]>]

The entire body is always included in the signature, so this recommendation is whether the field is included in the body itself. I feel that this is clear given the wider context of gnap but I might be making too many assumptions - do you have a recommendation for re wording this to avoid ambiguity?

Thank you,

- Justin
________________________________
From: Murray Kucherawy via Datatracker <[e-mail]>
Sent: Thursday, October 3, 2024 12:43 AM
To: The IESG <[e-mail]>
Cc: [e-mail] <[e-mail]>; [e-mail] <[e-mail]>; [e-mail] <[e-mail]>; [e-mail] <[e-mail]>
Subject: [GNAP] Murray Kucherawy's No Objection on draft-ietf-gnap-resource-servers-09: (with COMMENT)

Murray Kucherawy has entered the following ballot position for
draft-ietf-gnap-resource-servers-09: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-gnap-resource-servers/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

The document status question in the shepherd writeup was not completed.

Thanks to Rich Salz for his ARTART review.

Possibly an odd question, which you can blame on my DKIM background, but in
Section 3.3:

(BEGIN)
The RS signs the request with its own key and sends the value of the access
token as the body of the request as a JSON object with the following members:

[...]

proof (string): RECOMMENDED. The proofing method used by the client instance to
bind the token to the RS request. The value MUST be in the GNAP Key Proofing
Methods registry.

[...]

{
    "access_token": "OS9M2PMHKUR64TB8N6BW7OZB8CDFONP219RP1LT0",
    "proof": "httpsig",
    "resource_server": "7C7C4AZ9KHRS6X63AJAO"
}
(END)

Is the RECOMMENDED referring to the presence of "proof", or its inclusion in
what gets hashed for the signature?



--
TXAuth mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]