Re: [websec] new rev: draft-ietf-websec-strict-transport-sec-09

[=JeffH <[e-mail]>]

Howdy again,

Please note that there are a fair number of non-trivial and/or nuanced changes 
in several places in draft-ietf-websec-strict-transport-sec-09 (relative to rev 
-06) in response to various folks' [1] reviews (thx! And thx to PaulH for his 
ack on -08 recently).

It'd be great to get some acknowledgement that the changes meet expectations, 
especially those in these sections..

   6.1. Strict-Transport-Security HTTP Response Header Field

   6.1.1. The max-age Directive

   6.1.2. The includeSubDomains Directive

   8.1.  Strict-Transport-Security Response Header Field Processing

   8.1.1.  Noting a HSTS Host

   8.2.  Known HSTS Host Domain Name Matching

   8.3.  URI Loading and Port Mapping

   9.  Domain Name IDNA-Canonicalization

   10.1.  HSTS Policy expiration time considerations

   10.2.  Using HSTS in conjunction with self-signed public-key certificates

   11.4. Disallow Mixed Security Context Loads

   14. Security Considerations  (just the new intro paragraphs)

   14.6. Bogus Root CA Certificate Phish plus DNS Cache Poisoning Attack

   Appendix A. Design Decision Notes


There are also (editorial) changes in several other sections.

I believe these changes address issue tickets #s: 33, 37, 39, 40, 43, 44, 45, 
and 46.  I'll be closing these tickets soon unless issues are raised.

Please also see the change log below.

This URI will get you a side-by-side diff between -06 and -09..

https://tools.ietf.org/rfcdiff?url1=draft-ietf-websec-strict-transport-sec-06.txt&url2=draft-ietf-websec-strict-transport-sec-09.txt

thanks,

=JeffH

[1] Alexey M.
   Julian R.
   Murray K.
   Paul Hoffman
   Peter StA
   Tobias G.
   Barry L.

==============================================================


Appendix D. Change Log


     [RFCEditor: please remove this section upon publication as an RFC.]

     Changes are grouped by spec revision listed in reverse issuance
     order.

D.1.  For draft-ietf-websec-strict-transport-sec

       Changes from -08 to -09:

       1.  Added IESG Note to Section 3 "Conformance Criteria" per Barry
           Leiba's suggestion on the mailing list.  <https://
           www.ietf.org/mail-archive/web/websec/current/msg01200.html>

       2.  Added additional requirement #5 to requirements for STS header
           field directives in Section 6.1 per Alexey's review.  This
           completes the addressing of issue ticket #45.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/45>

       3.  Addressed editorial feedback in Murray's AppsDir review of
           -06.

           Most all of these changes were addressing detailed/small
           editorial items, however note the addition of a couple of
           introductory paragraphs in the Security Considerations
           section, as well as a re-written and expanded Section 14.6
           "Bogus Root CA Certificate Phish plus DNS Cache Poisoning
           Attack", as well the new item #5 to Appendix A "Design
           Decision Notes".

           This addresses issue ticket #46.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/46>

        Changes from -07 to -08:

        1.  Clarified requirement #4 for STS header field directives in
            Section 6.1, and removed "(which "update" this
            specification)".  Also added explicit "max-age=0" to Section
            6.1.1.  Reworked final sentence in 2nd para of Section 13.
            This addresses issue ticket #45.
            <http://trac.tools.ietf.org/wg/websec/trac/ticket/45>

        Changes from -06 to -07:

        1.  Various minor/modest editorial tweaks throughout as I went
            through it pursuing the below issue tickets.  Viewing a visual
            diff against -06 revision recommended.

        2.  fixed some minor editorial issues noted in review by Alexey,
            fixes noted in here: <https://www.ietf.org/mail-archive/web/
            websec/current/msg01163.html>

        3.  Addressed ABNF exposition issues, specifically inclusion of
            quoted-string syntax for directive values.  Fix STS header
            ABNF such that a leading ";" isn't required.  Add example of
            quoted-string-encoded max-age-value.  This addresses (re-
            opened) issue ticket #33.
            <http://trac.tools.ietf.org/wg/websec/trac/ticket/33>

        4.  Reworked sections 8.1 through 8.3 to ensure matching algorithm
            and resultant HSTS Policy application is more clear, and that
            it is explicitly stipulated to not muck with attributes of
            superdomain matching Known HSTS Hosts.  This addresses issue
            ticket #37.
            <http://trac.tools.ietf.org/wg/websec/trac/ticket/37>

        5.  Added reference to [I-D.ietf-dane-protocol], pared back
            extraneous discussion in section 2.2, and updated discussion
            in 10.2 to accomodate TLSA (nee DANE).  This addresses issue
            ticket #39.
            <http://trac.tools.ietf.org/wg/websec/trac/ticket/39>

        6.  Addressed various editorial items from issue ticket #40.
            <http://trac.tools.ietf.org/wg/websec/trac/ticket/40>

        7.  Loosened up the language regarding redirecting "http" requests
            to "https" in section 7.2 such that future flavors of
            permanent redirects are accommodated.  This addresses issue
            ticket #43.
            <http://trac.tools.ietf.org/wg/websec/trac/ticket/43>

        8.  Reworked the terminology and language in Section 9, in
            particular defining the term "putative domain name string" to
            replace "valid Unicode-encoded string-serialized domain name".
            This addresses issue ticket #44.
            <http://trac.tools.ietf.org/wg/websec/trac/ticket/44>


         Changes from -05 to -06:
                  .
                  .
                  .
                  .
---
end