Subject: [secdir] SECDIR review of draft-ietf-oauth-proof-of-possession-07

From: Chris Lonvick <[email-masked]>
Date: Tue, 8 Dec 2015 19:11:48 -0600

Hi,

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the IESG. 
These comments were written primarily for the benefit of the security 
area directors. Document editors and WG chairs should treat these 
comments just like any other last call comments.

Overall, the document looks pretty good.

I'd  recommend taking another look at the Security Considerations 
section. It is sufficient and contains everything that I think needs to 
be said. However, it may be a bit more clear if you separate the 
security concerns of the protocol, from the security concerns of 
credential management and policy. As I see it, the first and last 
paragraphs are concerned with credentials and policy while the middle 
paragraphs have statements about the actual protocol.

As a nit, I would suggest defining PoP at some point. While it's pretty 
obvious, I just like the traditional use of defining it before it's 
used.  :-)

Best regards,
Chris

---

From: Chris Lonvick <[email-masked]>
Date: Wed, 9 Dec 2015 18:58:09 -0600

Shoot! I cut-n-pasted an incorrect email address yesterday. Resending to 
get this to the authors and everyone. Sorry for the dup's to some people.
Best regards,
Chris

On 12/8/15 7:11 PM, Chris Lonvick wrote:
> ongoing effort to review all IETF documents being processed by the 
> IESG. These comments were written primarily for the benefit of the 
> security area directors. Document editors and WG chairs should treat 
> these comments just like any other last call comments.
>
> section. It is sufficient and contains everything that I think needs 
> to be said. However, it may be a bit more clear if you separate the 
> As a nit, I would suggest defining PoP at some point. While it's 
> pretty obvious, I just like the traditional use of defining it before 
> it's used.  :-)
>
> Best regards,
> Chris
>

---

From: Mike Jones <[email-masked]>
Date: Thu, 17 Dec 2015 15:07:51 +0000

Sorry for the slow response, Chris.  Your note had been auto-sorted into my Clutter folder where I didn't see it.  Stephen helpfully pointed out that he hadn't seen a response.  Responses inline below...

> -----Original Message-----
> From: Chris Lonvick [mailto:[email-masked]] 
> Sent: Thursday, December 10, 2015 1:58 AM
> To: [email-masked]; [email-masked]; [email-masked]
> Subject: Re: SECDIR review of draft-ietf-oauth-proof-of-possession-07
>
> Shoot! I cut-n-pasted an incorrect email address yesterday. Resending to get this to the authors and everyone. Sorry for the dup's to some people.
> Best regards,
> Chris
>

Fair enough.  I can group the security considerations items as you suggest.

> pretty obvious, I just like the traditional use of defining it before 

I agree with this tradition. :-)

> Chris

				Best wishes,
				-- Mike