Subject: Re: [jose] Opsdir review of draft-ietf-jose-jwk-thumbprint-05

From: Mike Jones <[email-masked]>
Date: Tue, 23 Jun 2015 18:43:58 +0000

Thanks for the review, Sarah.  Could you send us a link to the review comments in the tools?  (I poked around, including at https://svn.tools.ietf.org/area/ops/trac/wiki/Directorates, and couldn't find the review comments.)

				Thanks,
				-- Mike

-----Original Message-----
From: Sarah Banks [mailto:[email-masked]] 
Sent: Tuesday, June 23, 2015 11:36 AM
To: [email-masked]; <[email-masked]>
Subject: Opsdir review of draft-ietf-jose-jwk-thumbprint-05

I have reviewed this document as part of the Operational directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written with the intent of improving the operational aspects of the IETF drafts. Comments that are not addressed in last call may be included in AD reviews during the IESG review.  Document editors and WG chairs should treat these comments just like any other last call comments.

Document reviewed:  draft-ietf-jose-jwk-thumbprint-05

Summary: Ready to go, no nits, 5 comments (see tools).

Overall, if I were implementing this in code, I'd appreciate the preamble, thanks for the clear description. I also appreciate that the security section was well considered and discussed. I have no major comments, other than that it read like .. an algorithm to me, and I was a bit surprised to see it on the Standards track, rather than informational, but that's just a comment, not a nit or problem. The draft is ready to go.

Thanks
Sarah

---

From: Mike Jones <[email-masked]>
Date: Tue, 23 Jun 2015 19:51:14 +0000

Thanks, Sarah.  Here's the output of the tool and responses to it:

  -- Looks like a reference, but probably isn't: '1' on line 413

  -- Looks like a reference, but probably isn't: '0' on line 413

  == Missing Reference: 'specified ' is mentioned on line 412, but not defined

The lines referenced by the output above are:
411        [JWA].)  For example, if an RSA key were to use "e":"AAEAAQ"
412        (representing [0, 1, 0, 1]) rather than the specified correct
413        representation of "e":"AQAB" (representing [1, 0, 1]), a different

All of these three nits are false positives in the tool output.

  -- Possible downref: Non-RFC (?) normative reference: ref. 'SHS'

  -- Possible downref: Non-RFC (?) normative reference: ref. 'UNICODE'

It's appropriate for both of these references to be normative, for the same reasons that they are in http://tools.ietf.org/html/rfc7518#section-10.1.

Also, about whether the draft is standards-track or informational, this was discussed by the working group and because it's being normatively referenced by other specs, the decision was to leave it standards-track.

                                                            Best wishes,
                                                            -- Mike

From: Sarah Banks [mailto:[email-masked]]
Sent: Tuesday, June 23, 2015 12:30 PM
To: Mike Jones
Cc: [email-masked]; <[email-masked]>; [email-masked]
Subject: Re: Opsdir review of draft-ietf-jose-jwk-thumbprint-05

Hey Mike, they were from the nits checker within tools, and click on the "nits" button. Here's the (long) URL to it from my browser:

https://www.ietf.org/tools/idnits?url=https://www.ietf.org/archive/id/draft-ietf-jose-jwk-thumbprint-05.txt

Thanks
Sarah

On Jun 23, 2015, at 11:43 AM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:

                                                Thanks,
                                                -- Mike

-----Original Message-----
From: Sarah Banks [mailto:[email-masked]]
Sent: Tuesday, June 23, 2015 11:36 AM
To: [email-masked]<mailto:[email-masked]>; <[email-masked]<mailto:[email-masked]>>
Subject: Opsdir review of draft-ietf-jose-jwk-thumbprint-05

Thanks
Sarah

---

From: Sarah Banks <[email-masked]>
Date: Tue, 23 Jun 2015 12:29:45 -0700

https://www.ietf.org/tools/idnits?url=https://www.ietf.org/archive/id/draft-ietf-jose-jwk-thumbprint-05.txt <https://www.ietf.org/tools/idnits?url=https://www.ietf.org/archive/id/draft-ietf-jose-jwk-thumbprint-05.txt>

Thanks
Sarah
 
> On Jun 23, 2015, at 11:43 AM, Mike Jones <[email-masked]> wrote:
>

---

From: Sarah Banks <[email-masked]>
Date: Tue, 23 Jun 2015 14:22:10 -0700

Hi Mike,
	My apologies, I didn't realize you were looking for a cut/paste of the comments - they were minor details to resolve anyhow. Regarding the standards/informational, no problem, it was just a comment from an outside reader, that's all.

Thanks
Sarah

> On Jun 23, 2015, at 12:51 PM, Mike Jones <[email-masked]> wrote:
> 
> Thanks, Sarah.  Here’s the output of the tool and responses to it:
>  
> It’s appropriate for both of these references to be normative, for the same reasons that they are in http://tools.ietf.org/html/rfc7518#section-10.1 <http://tools.ietf.org/html/rfc7518#section-10.1>.
>  
> Also, about whether the draft is standards-track or informational, this was discussed by the working group and because it’s being normatively referenced by other specs, the decision was to leave it standards-track.
>  
>                                                             Best wishes,
>                                                             -- Mike
>  
> From: Sarah Banks [mailto:[email-masked] <mailto:[email-masked]>] 
> Cc: [email-masked] <mailto:[email-masked]>; <[email-masked] <mailto:[email-masked]>>; [email-masked] <mailto:[email-masked]>
> On Jun 23, 2015, at 11:43 AM, Mike Jones <[email-masked] <mailto:[email-masked]>> wrote:
>  
> Thanks for the review, Sarah.  Could you send us a link to the review comments in the tools?  (I poked around, including athttps://svn.tools.ietf.org/area/ops/trac/wiki/Directorates <https://svn.tools.ietf.org/area/ops/trac/wiki/Directorates>, and couldn't find the review comments.)
> 
>                                                 Thanks,
>                                                 -- Mike
> 
> From: Sarah Banks [mailto:[email-masked] <mailto:[email-masked]>] 
> To: [email-masked] <mailto:[email-masked]>; <[email-masked] <mailto:[email-masked]>>