Re: [Unbearable] Ben Campbell's Discuss on draft-ietf-tokbind-https-14: (with DISCUSS and COMMENT)

[Dirk Balfanz <[e-mail]>]

Hi Ben,

thanks for the feedback. Most of it is addressed in the new draft (
https://tools.ietf.org/html/draft-ietf-tokbind-https-16). See below
(inline) for details.

On Wed, May 9, 2018 at 1:38 PM Ben Campbell <[e-mail]> wrote:

> Ben Campbell has entered the following ballot position for
> draft-ietf-tokbind-https-14: Discuss
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-tokbind-https/
>
>
>
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
>
> I plan to ballot "YES", but I want to clear up once concern first:
>
> After reading section 6 several times, I don't know what it means. I think
> it's [...]
>

Addressed in new draft.


>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> Substantive Comments:
>
> §1.1: Please consider using the boilerplate from 8174 across the cluster.
> Both
> this and the protocol draft have lower case keyword instances.
>

Addressed in new draft.


>
> §8.2:
> - Does it really make sense to wait for a user to request the keys be
> expired?
> I suspect the average user does this about never. Did the working group
> discuss
> possibly making the keys default to expiring after some period of time?


Yes, we did discuss it. This was chosen consciously to be in sync with
cookies and their expirations / manual user-initiated purges.

- Why
> is the SHOULD in paragraph 2 not a MUST?
>

Addressed in new draft.


>
> Editorial Comments:
>
> §2:
> - Paragraph 1: "The ABNF of the Sec-Token-Binding header field is (in
> [RFC7230]
> style, see also Section 8.3 of [RFC7231]):" The open parenthesis before
> "in"
> seems misplaced. Also, as written the comma after "style" creates a comma
> splice. (Note that this pattern occurs elsewhere in the document.)
>
> - Paragraph 3: The paragraph is a single hard-to-parse sentence. Please
> consider breaking into simpler sentences.
>

Addressed in new draft.


>
> - example: Am I correct to assume the backslashes are just for print
> purposes
> and are not in the actual message? If so, please mention that.
>

Addressed in new draft.


>
> § 2.1:
> - first paragraph, "Within the latter context...": There was no former
> context.
> I suggest "Within that context..."


Addressed in new draft.


> - 2nd paragraph: The first sentence is hard
> to parse. I suggest breaking it into separate paragraphs, or restructure
> without the center-imbedding.


Addressed in new draft.


> - 2nd to last paragraph: Does "SHOULD generally"
> mean the same as just "SHOULD"?
>

Addressed in new draft.


>
> §5.1: 2nd paragraph: Unneeded comma in "... itself, to another server..."
>

Addressed in new draft.


>
> §5.2,
> - last bullet: " (between client and Token Consumer)" seems more than
> parenthetical. Please consider removing the parentheses.


Addressed in new draft.


> - paragraph after last
> bullet: The parenthetical phrase starting with "(proving possession...) is
> quite long and makes the sentence hard to parse. Given that the concept is
> covered in the immediately preceding paragraph, can it be removed?
>

Addressed in new draft.


>
> §7.1 and §7.2: These sections seem to be copied from (or restate
> requirements
> in) the protocol and negotiation drafts. Can they be included by reference
> instead, or at least attributed?
>

Addressed in new draft.


>
> §7.2, 2nd paragraph: This seams like a restatement of §7.1.
>

Addressed in new draft.


> §8.3: Unneeded comma in first sentence.
>

Addressed in new draft.

Thanks again for the thoughtful comments!

Dirk.