Re: [Unbearable] Adam Roach's Yes on draft-ietf-tokbind-https-14: (with COMMENT)

[Nick Harper <[e-mail]>]

On Mon, Jun 4, 2018 at 3:11 PM, Adam Roach <[e-mail]> wrote:

> On 6/4/18 4:56 PM, Dirk Balfanz wrote:
>
> Hi Adam,
>
> thanks for the feedback. Most of it is addressed in the new draft (
> https://tools.ietf.org/html/draft-ietf-tokbind-https-16). See below
> (inline) for details.
>
>
>
> Thanks! Some responses inline.
>
>
>
>> ----------------------------------------------------------------------
>> COMMENT:
>> ----------------------------------------------------------------------
>>
>> Thanks to everyone who worked on this document. I am balloting "Yes", but
>> still have a handful of comments, including several that I believe are
>> rather important.
>>
>>
>> ------------------------------------------------------------
>> ---------------
>>
>> §2:
>>
>> >  Once a client and server have negotiated the Token Binding Protocol
>> >  with HTTP/1.1 or HTTP/2 (see [I-D.ietf-tokbind-protocol] and
>> >  [I-D.ietf-tokbind-negotiation])
>>
>> Presuming this document is intended to cover use of TLS 1.3, I believe
>> this
>> list needs to also include [I-D.ietf-tokbind-tls13].
>>
>
> Actually, the document doesn’t address TLS 1.3 - that will be covered in a
> separate document.
>
>
> Please adjust the title, abstract, and introduction to make this clear. I
> see neither prose nor technical mechanism in this document that precludes
> use with TLS 1.3, and it's virtually guaranteed that implementors will try
> to use it with TLS 1.3 unless there is clear text saying not to.
>

I think this document does cover using Token Binding with TLS 1.3, but only
once draft-ietf-tokbind-tls13 is published. (I.e. before the draft is
published, it does not cover TLS 1.3, because draft-ietf-tokbind-protocol
is limited to TLS 1.2, but once draft-ietf-tokbind-tls13 is published, this
automatically covers TLS 1.3 as well.)