Re: [Unbearable] HTTPSTB updates and respin WGLC

[John Bradley <[e-mail]>]

Thanks for the update.

Lets get this done before you ship Creators update:).

John B.

> On Feb 6, 2017, at 9:01 PM, Andrei Popov <[e-mail]> wrote:
> 
> Hi John,
> 
> I believe Jeff is working on another PR, then once that's merged we should be able to publish the 3 updated I-Ds.
> 
> Cheers,
> 
> Andrei
> 
> -----Original Message-----
> From: John Bradley [mailto:[e-mail]] 
> Sent: Monday, February 6, 2017 3:52 PM
> To: Andrei Popov <[e-mail]>
> Cc: =JeffH Hodges <[e-mail]>; Dirk Balfanz <[e-mail]>; IETF TokBind WG <[e-mail]>
> Subject: Re: [Unbearable] HTTPSTB updates and respin WGLC
> 
> When do you think you guys can push “final" versions for the WG?
> 
> I am hoping we can have these specs wrapped up by Chicago.
> 
> John B.
>> On Feb 6, 2017, at 3:30 PM, Andrei Popov <[e-mail]> wrote:
>> 
>>> Though, in the plural case, would using "keys" rather than "key pairs" 
>> work for you?
>> 
>> This is just aesthetic preference; I can live with either phrasing...
>> 
>> -----Original Message-----
>> From: Unbearable [mailto:[e-mail]] On Behalf Of =JeffH
>> Sent: Monday, February 6, 2017 10:17 AM
>> To: Andrei Popov <[e-mail]>; Dirk Balfanz <[e-mail]>
>> Cc: IETF TokBind WG <[e-mail]>
>> Subject: Re: [Unbearable] HTTPSTB updates and respin WGLC
>> 
>> cf: <https://www.ietf.org/mail-archive/web/unbearable/current/msg01147.html>
>> [ i suspect Dirk had not seen Andrei's email prior to merging PR #92 ]
>> 
>> Andrei wrote on Fri, 3 Feb 2017 01:51:23 +0000:
>>> 
>>> A few editorial suggestions below.
>>> 
>>>> I think this needs to be rephrased:
>>>> The Token Binding ID of a TLS connection is constructed using  >> the public key OF a private-public key pair, OF which  >> the client proves possession OF the private key to  >> the server.
>>> Perhaps better to just split this into two sentences:
>>> 
>>> The Token Binding ID of a TLS connection is constructed using the  > public key of a private-public key pair.
>>> The client proves possession of the corresponding private key.
>> 
>> thx, queued.
>> 
>> 
>>>> (clients use different Token Binding key pairs for different...
>>>> The scoping for those Token Binding key pairs generated by Web  >> browsers in...
>>>> browsers MAY use different key pair scoping rules.
>>>> For privacy reasons, clients use different Token Binding key pairs  >> of the Token Binding key pair. It is possible that the Token  >> <section title="Scoping of Token Binding Key Pairs"...
>>>> [...]
>>> 
>>> While not wrong, all these key pairs seem unnecessary. The Token  > Binding key is asymmetric, so clearly it has a private and public  > component.
>> 
>> It seems inaccurate and potentially confusing to speak of a singular "token binding key" when we have explicitly termed it a "private-public key pair", and it is indeed two separate (although related) artifacts.
>> 
>> Though, in the plural case, would using "keys" rather than "key pairs" 
>> work for you?
>> 
>>>> contains both: a proof of possession of the provided Token Binding  >> ID, as well as a proof of possession of the referred Token Binding  >> ID  > It's a proof of possession of a Token Binding key, I think.
>> 
>> ok, queued, thx again.
>> 
>> =JeffH
>> 
>> _______________________________________________
>> Unbearable mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/unbearable
>> 
>> _______________________________________________
>> Unbearable mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/unbearable
>