Subject: Re: [Ace] Last Call for Comments on ACE Charter Text

From: Margaret Wasserman <[email-masked]>
Date: Sat, 26 Apr 2014 07:14:35 -0400

Hi Robert, 

One question for the WG based on your comments on the charter text:

Would we be okay with a solution that only works for REST-based applications, or will we also need to secure any other sorts of communication between Clients and Resource Servers?

Margaret

-------- Original message --------
From Robert Cragie <[email-masked]> 
Date: 04/15/2014  11:53 AM  (GMT-05:00) 
To Hannes Tschofenig <[email-masked]>,Rene Struik <[email-masked]> 
Cc [email-masked] 
Subject Re: [Ace] Last Call for Comments on ACE Charter Text 
 
A couple of small comments inline. I am OK with the rest of the changes.

Robert

On 14/04/2014 1:25 PM, Hannes Tschofenig wrote:
> Hi Rene,
>   
> thanks for the review comments. I have updated the charter text accordingly.
>   
> A few remarks inline:
>   
>
> Gesendet: Donnerstag, 10. April 2014 um 22:58 Uhr
> Von: "Rene Struik" <[email-masked]>
> An: "Hannes Tschofenig" <[email-masked]>, "[email-masked]" <[email-masked]>
> Betreff: Re: [Ace] Last Call for Comments on ACE Charter Text
>
> Hi Hannes:
>
> I had a look at the charter text. I do agree with the two tasks identified in the charter.
>
> I do have some some comments on the (rather lengthy) prelude to the enumeration of these two tasks. These comments do not matter if the group agrees that the charter does not try and steer into a particular solution direction (as some comments on the list have indeed suggested to be the case). My comments are worded in case this is not so.
>
> Small comments:
> a) 2nd para, l. 3: replace "authorization decisions" by "authorization criteria" or "authorization policy". After all, decisions are not stored, but acted upon.
>   
> [hannes] Fixed.
<RCC>I have no particular issue with the change but I think it was OK as 
it was, as an authorization *policy* can often be static, therefore not 
requiring storage. Decisions certainly are stored and form the basis for 
access control.</RCC>
>   
> b) 2nd para, l. -1: replace "resource server" by "resource owner", "resource holder", or similar. This would make it clearer that the "server" is the device that actually stores the info the client is soliciting.
>
> [hannes] I changed the wording to make clear that we are talking about the server that is holding the resource.
<RCC>The way it is written now could read that clients can hold 
resources - not the case in a REST architecture. Again, I thought it was 
OK as it way</RCC>

_______________________________________________
Ace mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ace

---

From: Seetharama Rao Durbha <[email-masked]>
Date: Mon, 28 Apr 2014 16:51:29 +0000

Hi Robert,

Firstly, I am a newcomer to this group – so, hello to everyone. I only recently started following this group actively, but am very much interested in the area.

Just on the issue of 'a solution that only works for REST-based applications', in my mind, we have to first define the properties  and parameters for a secure communication independent of the transport protocol, and then create mappings for individual protocols. So there needs to be a 'core' specification, and then related specifications for mappings/profiles.

--Seetharama Durbha
Lead Security Architect
CableLabs

Margaret

-------- Original message --------
>From Robert Cragie <[email-masked]<mailto:[email-masked]>>
Date: 04/15/2014 11:53 AM (GMT-05:00)
To Hannes Tschofenig <[email-masked]<mailto:[email-masked]>>,Rene Struik <[email-masked]<mailto:[email-masked]>>
Cc [email-masked]<mailto:[email-masked]>
Subject Re: [Ace] Last Call for Comments on ACE Charter Text

Robert

On 14/04/2014 1:25 PM, Hannes Tschofenig wrote:
> Von: "Rene Struik" <[email-masked]<mailto:[email-masked]>>
> An: "Hannes Tschofenig" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>

_______________________________________________
Ace mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ace

---

From: Robert Cragie <[email-masked]>
Date: Mon, 28 Apr 2014 18:28:57 +0100

Hi Margaret,

The idea is to use REST-based applications as a starting point, which is
the language used in the charter. The charter does also say that "the
working group will verify whether the same mechanisms are also applicable
beyond the use of CoAP and DTLS". So I would say it is not restricted to
REST-based applications.

Robert

On 26 April 2014 12:14, Margaret Wasserman <[email-masked]> wrote:

> Would we be okay with a solution that only works for REST-based
> applications, or will we also need to secure any other sorts of
> communication between Clients and Resource Servers?
>
> Margaret
>
>
>
>
> > I do have some some comments on the (rather lengthy) prelude to the
> enumeration of these two tasks. These comments do not matter if the group
> agrees that the charter does not try and steer into a particular solution
> direction (as some comments on the list have indeed suggested to be the
> case). My comments are worded in case this is not so.
> >
> > Small comments:
> > a) 2nd para, l. 3: replace "authorization decisions" by "authorization
> criteria" or "authorization policy". After all, decisions are not stored,
> but acted upon.
> >
> > [hannes] Fixed.
> > b) 2nd para, l. -1: replace "resource server" by "resource owner",
> "resource holder", or similar. This would make it clearer that the "server"
> is the device that actually stores the info the client is soliciting.
> >