Re: [Unbearable] Adam Roach's Yes on draft-ietf-tokbind-https-14: (with COMMENT)

[Adam Roach <[e-mail]>]

On 6/5/18 1:46 PM, Nick Harper wrote:
>
>
> On Mon, Jun 4, 2018 at 3:11 PM, Adam Roach <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>     On 6/4/18 4:56 PM, Dirk Balfanz wrote:
>>     Hi Adam,
>>
>>     thanks for the feedback. Most of it is addressed in the new draft
>>     (https://tools.ietf.org/html/draft-ietf-tokbind-https-16
>>     <https://tools.ietf.org/html/draft-ietf-tokbind-https-16>). See
>>     below (inline) for details.
>>
>>
>
>     Thanks! Some responses inline.
>
>
>>
>>         ----------------------------------------------------------------------
>>         COMMENT:
>>         ----------------------------------------------------------------------
>>
>>         Thanks to everyone who worked on this document. I am
>>         balloting "Yes", but
>>         still have a handful of comments, including several that I
>>         believe are
>>         rather important.
>>
>>
>>         ---------------------------------------------------------------------------
>>
>>         §2:
>>
>>         >  Once a client and server have negotiated the Token Binding
>>         Protocol
>>         >  with HTTP/1.1 or HTTP/2 (see [I-D.ietf-tokbind-protocol] and
>>         >  [I-D.ietf-tokbind-negotiation])
>>
>>         Presuming this document is intended to cover use of TLS 1.3,
>>         I believe this
>>         list needs to also include [I-D.ietf-tokbind-tls13].
>>
>>
>>     Actually, the document doesn’t address TLS 1.3 - that will be
>>     covered in a separate document.
>
>     Please adjust the title, abstract, and introduction to make this
>     clear. I see neither prose nor technical mechanism in this
>     document that precludes use with TLS 1.3, and it's virtually
>     guaranteed that implementors will try to use it with TLS 1.3
>     unless there is clear text saying not to.
>
>
> I think this document does cover using Token Binding with TLS 1.3, but 
> only once draft-ietf-tokbind-tls13 is published. (I.e. before the 
> draft is published, it does not cover TLS 1.3, because 
> draft-ietf-tokbind-protocol is limited to TLS 1.2, but once 
> draft-ietf-tokbind-tls13 is published, this automatically covers TLS 
> 1.3 as well.)


Then please add an informative reference to draft-ietf-tokbind-tls13.

/a