Subject: [saag] Shepherd Review: draft-richer-vectors-of-trust-07

From: Sean Turner <[email-masked]>
Date: Mon, 12 Mar 2018 19:08:34 +0000

Kathleen (and later Ben) asked me to Shepherd draft-richer-vectors-of-trust.  Here’s the review I sent to the authors (should have sent it here too).  I threw in a PR to the repo to take care of the changes - except s8 I wasn’t sure where to refer:

   https://github.com/vectorsoftrust/strawman/pull/7

tl;dr: I like the idea after I got over my RBAC flashbacks!

I’ll be honest that at first I was like here we go again, but I do like that you managed to keep it to only 4 vectors initially and allow it to be expanded later.  I thought the recommendation for the second marker (alpha vs numeric) was pretty much what I would have done: P needs to have # the others not so much.  Note that for the same reasons you did C0 you could also do A0 - it is a “No”.

I was initially a little confused about it being standards track because it’s specifying a framework, but you are specifying a wire format so that seems okay in my book.

Question in s3.4: When you say “such as a session cookie in a web browser” you talking about HTTP’s cookies right and not TLSs?
Answer: Yes (see PR).

The IANA considerations section looks fine.  I assume you two would offer to the DEs?
Answer: Yes.

I can see some asking for more information for the Sec/Priv sections, but honestly what you got there is pretty much it: don’t send these things in the clear, bind them with cryptography, and don’t share too much otherwise you’ll give away something you might not have meant to.   So, in my book that’s probably good enough.

Nits: 

0) Update to match the new terminology paragraph:

 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
 NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
  "MAY", and "OPTIONAL" in this document are to be interpreted as
  described in BCP 14 [RFC2119] [RFC8174] when, and only when, they
  appear in all capitals, as shown here.

1) s5.1: vtr vs votr?  I know everybody loves the 3-letter once but it make more sense that vot is the request and votr is the response. I’m in no way going any where near a mat to argue this point though.

Answer: JSON loves the 3-letter so we’ll just leave it alone.

2) s8: sentence end abruptly:

3) I think both SP-800 references are missing something.

4) I-D nits complains about two outdated references:

 ** Obsolete normative reference: RFC 5226 (Obsoleted by RFC 8126)

 ** Obsolete normative reference: RFC 7159 (Obsoleted by RFC 8259)