Subject: Last call comments about draft-housley-tls-authz-extns-07

From: <[email-masked]>
Date: Fri, 2 Mar 2007 16:08:26 +0200

1) Given the situation, I would find Experimental a more appropriate
status for the document (and it seems that the required IANA
assignments can be obtained without being on standards track, so
probably no changed would be needed in the document).

2) If this was published in a more academic environment, it would be
proper (and required) to cite related work, tracing the source of
ideas that were not entirely new. We don't usually have extensive
citations in RFCs, but in this context, perhaps it would be
appropriate to mention the previous proposal for sending ACs in TLS
(draft-ietf-tls-attr-cert from 1998) in the Acknowledgements section.

3) Recent discussions on the TLS WG mailing list pointed out a
possible problem in the draft (which it might not be too late to fix):
there are some 2-byte length fields, which limit contents to 65535
bytes.  That might be plenty for X.509 ACs (although TLS does use
three-byte length field for X.509 PKCs), but perhaps not so plenty for
SAML assertions.

Best regards,
Pasi

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Spencer Dawkins <[email-masked]>
Date: Fri, 02 Mar 2007 09:16:50 -0600

Hi, Pasi,

On your second point - While the IETF is not a particularly academic 
environment, it may also be appropriate to encourage the citation of prior 
art that would move the marker for "inventions" back nearly 10 years... in a 
place where we can find it in ten MORE years.

Thanks,

Spencer

From: <[email-masked]>
To: <[email-masked]>
Sent: Friday, March 02, 2007 8:08 AM
Subject: Last call comments about draft-housley-tls-authz-extns-07

---

From: Russ Housley <[email-masked]>
Date: Fri, 02 Mar 2007 16:23:42 -0500

>(draft-ietf-tls-attr-cert from 1998) in the Acknowledgements section.

This takes a very different approach.  Stephen and I co-authored RFC 
3281, which is referenced.  I do not think that Stephen's ideas about 
integrating Attribute Certificates into TLS had any impact on the 
design in the current document.

Russ

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 02 Mar 2007 23:05:05 +0000

Russ Housley wrote:
> integrating Attribute Certificates into TLS had any impact on the design 
> in the current document.

There are of course similarities that might or might not be important
when considering prior art, basically the date is what you'd care
about really then anyway.

FWIW, I don't think we want to start bouncing specs because they
don't pay homage - in this case all the similarities are probably
the only obvious ways to add authorization tokens to a TLS
handshake. Such downrefs to dead documents would anyway add yet
more cruft to the RFC process, so let's not.

S.

---

From: <[email-masked]>
Date: Mon, 5 Mar 2007 11:24:55 +0200

> design in the current document.

Well, while draft-ietf-tls-attr-cert certainly contains a lot of
stuff that isn't in draft-housley-tls-authz-extns (such as AC
acquisition, hints about what ACs the client should consider
presenting, etc.), there's some overlap as well.

For example, a very basic case where the client presents an AC 
containing a role or security clearance to the server, and the 
server uses this to determine what the client is authorized to 
access, is explicitly mentioned in both documents, and would work 
almost identically.

Best regards,
Pasi