Re: [Webpush] AD Evaluation: draft-ietf-webpush-encryption

[Martin Thomson <[e-mail]>]

Thanks Adam,

Should you care: https://github.com/webpush-wg/webpush-encryption/pull/15

I can generate a new version and submit it at a time of your choosing
if these changes are acceptable.

On 11 July 2017 at 09:04, Adam Roach <[e-mail]> wrote:
> The final paragraph of section 2.1 uses the word "any" in a rather sweeping
> fashion, implying that the algorithms, key sizes, and consequent strengths
> for providing authentication, integrity, and confidentiality are immaterial.
> I would suggest qualifying this more carefully.

I've changed this to "An authenticated communication mechanism that
provides adequate confidentiality and integrity protection, such as
HTTPS [...]"

> The summary in section 3.4 is greatly appreciated. I'm a bit confused about
> the "salt = random(16)"

That's an error.  I have moved this to the right place.

> Section 4: s/the some of the length/the sum of the length/

Not in my copy; I think that Matt fixed this for me already.

> Section 5: "base64url" needs a definition -- I would suggest citing RFC
> 4648, section 5.

How did I miss that...

> The final ciphertext in the appendix appears to contain a spurious space.

I broke these into 32 character chunks so that line wrapping wouldn't
hurt too much, that's all.  I'll explain that better.