[websec] Pete Resnick's No Objection on draft-ietf-websec-key-pinning-19: (with COMMENT)

["Pete Resnick" <[e-mail]>]

Pete Resnick has entered the following ballot position for
draft-ietf-websec-key-pinning-19: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-websec-key-pinning/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

1: The first sentence is quite confusing. Might I suggest instead:

   This document defines a new HTTP header that enables user agents
   (UAs) to determine which Subject Public Key Info (SPKI) structures
   will be present in the web host's certificate chain in future TLS
   [RFC5246] connections.

2.1:

   Public-Key-Directives = [ directive ] *( OWS ";" OWS [ directive ] )

Are you sure that's correct? First of all, it may be completely empty.
That seems like something you wouldn't want. Second of all, it allows for
semicolons without directives between them, which may or may not be what
you want. It's not clear to me why you made this semicolon-delimited
instead of comma-delimited, which would be much more in line with the
rest of HTTP. Then you'd simply get:

   Public-Key-Directives = 1#directive

But if you insist on semicolons, you want either:

   Public-Key-Directives = directive *( OWS ";" OWS directive )

or if you want to allow for empty elements:

   Public-Key-Directives = *( ";" OWS ) directive *( OWS ";" [ OWS
    directive ] )
    
If the following is acceptable:

   Public-Key-Directives: ;;;;;

then your original is fine.

s/hahs/hash

10.1:

Update 4627 to 7159

I think W3C.REC-html401-19991224 is informative. This document says that
you MUST NOT do what's in that document.