Re: [Unbearable] I-D Action: draft-ietf-tokbind-https-10.txt

Skickat från min iPhone

> 21 juli 2017 kl. 13:03 skrev Denis <denis.ietf@free.fr>:
> 
> Leif,
> 
> The text that was quoted is in the Security Considerations section under section "7.1.  Security Token Replay" 
> from draft-ietf-tokbind-protocol.

I was not responding to that but to your claim that it is not reasonable to expect implementors to read the full set of specs. It is.

> 
> I already said on the list that the text does not fit under section 7.1 since it is not a security token replay in any sense, 
> since the legitimate client is not playing anything, so it cant' be a replay.
> 
> It should be under a specific section called, e.g.: Client collusion.
>  
> It is particularly important that readers realize that this protection is not effective under some circumstances.
> 
> Is there any harm to warn the user in both documents  ?
> 
> Denis
> 
>>> On 2017-07-21 11:40, Denis wrote:
>>> Nick,
>>> 
>>> A person reading draft-ietf-tokbind-https will not necessarily also read
>>> draft-ietf-tokbind-protocol.
>> Since there is text in draft-ietf-tokbind-https with normative
>> references to draft-ietf-tokbind-protocol I don't believe that
>> is a reasonable assumption.
>> 
>> 	Cheers Leif
>> 
>> _______________________________________________
>> Unbearable mailing list
>> Unbearable@ietf.org
>> https://www.ietf.org/mailman/listinfo/unbearable
> 