[Unbearable] A storm in a cup of tea (related to draft-ietf-tokbind-protocol-13)

[Denis <[e-mail]>]

On February 27, I sent an email with the following topic: WGLC 3 on core 
documents.

    Comments on draft-ietf-tokbind-protocol-13 (The Token Binding
    Protocol Version 1.0)

    On page 14 within the Security Considerations section, I appreciate
    the fact that the following sentences have been added:

    *The Token Binding protocol does not prevent cooperating clients from*

    *sharing a bound token.A client could intentionally export a bound*

    *token with the corresponding Token Binding private key, or perform*

    *signatures using this key on behalf of another client.*

    However, these sentences have been placed inside section 7.1 which
    is called "Security Token Replay".
    This security consideration has nothing to do with "Security Token
    Replay" but with "Client collusion".

    Therefore, these sentences should be placed under a new section
    called: "7.2. Client collusion".

I was quite surprised to see that Leif Johansson reacted violently. He 
raised *a storm in a cup of tea*.

In any case, this threat does not belong to a subsection called 
"Security Token Replay" since there is no replay of any kind.

A separate section should be used to mention that attack.


*A spade should be called a spade*. Now, if Leif would like to call it 
differently, why not ?

For example, it could also be called "*Security Token Forwarding*"


Hence, up to now, I consider that this comment has not been solved to my 
satisfaction.


Denis