Subject: [Id-event] Kathleen Moriarty's No Objection on charter-ietf-secevent-00-00: (with COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Thu, 13 Oct 2016 06:25:27 -0700

Kathleen Moriarty has entered the following ballot position for
charter-ietf-secevent-00-00: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-secevent/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Shouldn't the method for delivering the event be a secure method?

How about adding on a sentence after the following section:
The Security Events working group will produce a standards-track Event
Token
specification that includes:
 - A JWT extension for expressing security events
 - A syntax that enables event-specific data to be conveyed
This Event Token specification will be event transport independent.

Adding: A secure transport will be specified.

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 13 Oct 2016 14:29:12 +0100

Hi Kathleen,

> https://datatracker.ietf.org/doc/charter-ietf-secevent/

I think the charter is saying that work on a specific transport is out
of scope. I would rather this WG not work on any transport, but I agree
that a secure transport should be recommended.

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 13 Oct 2016 09:37:26 -0400

> that a secure transport should be recommended.

Yes, that's what I meant by specified, but haven't had any caffeine yet and
should not have used that word. Recommended is a good choice.  Thank you.

-- 

Best regards,
Kathleen

---

From: Phil Hunt <[email-masked]>
Date: Thu, 13 Oct 2016 09:40:52 -0400

Maybe I am reading the charter wrong. But the charter should indicate that we will develop one secure transport based on HTTP POST.

With that said, it is entirely possible that SETs could be delivered over insecure (depending on what is meant) channels. We chose JWT because they can themselves be signed and encrypted.  I have initially suggested a registry be defined that would help shape future transport specs by alerting profiling authors to cover a minimum set of security issues either in transport or within the token itself.

Phil

@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On Oct 13, 2016, at 9:37 AM, Kathleen Moriarty <[email-masked]> wrote:
> 
> 
> 
> On Thu, Oct 13, 2016 at 9:29 AM, Alexey Melnikov <[email-masked] <mailto:[email-masked]>> wrote:
> Hi Kathleen,
> 
> > https://datatracker.ietf.org/doc/charter-ietf-secevent/ <https://datatracker.ietf.org/doc/charter-ietf-secevent/>
> >
> >
> >
> Yes, that's what I meant by specified, but haven't had any caffeine yet and should not have used that word. Recommended is a good choice.  Thank you.
> 
> 
> 
> -- 
> 
> Best regards,
> Kathleen
> _______________________________________________
> Id-event mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/id-event <https://www.ietf.org/mailman/listinfo/id-event>

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 13 Oct 2016 10:07:25 -0400

Hi Phil,

On Thu, Oct 13, 2016 at 9:40 AM, Phil Hunt <[email-masked]> wrote:

> Maybe I am reading the charter wrong. But the charter should indicate that
> we will develop one secure transport based on HTTP POST.
>

Can you point out where in the charter you see it already covered as I'm
missing it and it seems others are too.

>
> With that said, it is entirely possible that SETs could be delivered over
> insecure (depending on what is meant) channels. We chose JWT because they
> can themselves be signed and encrypted.  I have initially suggested a
> registry be defined that would help shape future transport specs by
> alerting profiling authors to cover a minimum set of security issues either
> in transport or within the token itself.
>

Yes, Stephen mentioned this as well and I agree, but some mention of
security methods should be in the charter.  I tried to make as simple a
statement as possible to not restrict it, but feel free to propose
something else that encompasses the possible acceptable solutions.

Thank you,
Kathleen

> www.independentid.com
> [email-masked]
> Yes, that's what I meant by specified, but haven't had any caffeine yet
> and should not have used that word. Recommended is a good choice.  Thank
> you.
>
>
>
> --
>
> Best regards,
> Kathleen
> [email-masked]
> https://www.ietf.org/mailman/listinfo/id-event
>
>
>

-- 

Best regards,
Kathleen

---

From: Phil Hunt <[email-masked]>
Date: Thu, 13 Oct 2016 10:23:18 -0400

Right here (first bullet):
The working group will also develop a simple standards-track Event Delivery
specification that includes:
 - A method for delivering events using HTTP POST (push)
 - Metadata for describing event feeds
 - Methods for subscribing to and managing event feeds
 - Methods for validating event feed subscriptions

Phil

@independentid

> On Oct 13, 2016, at 10:07 AM, Kathleen Moriarty <[email-masked]> wrote:
> 
> Hi Phil,
> 
> On Thu, Oct 13, 2016 at 9:40 AM, Phil Hunt <[email-masked] <mailto:[email-masked]>> wrote:
> Can you point out where in the charter you see it already covered as I'm missing it and it seems others are too.
>  
> 
> Yes, Stephen mentioned this as well and I agree, but some mention of security methods should be in the charter.  I tried to make as simple a statement as possible to not restrict it, but feel free to propose something else that encompasses the possible acceptable solutions.
> 
> Thank you,
> Kathleen
>  
> 
> Phil
> 
> @independentid
>> On Oct 13, 2016, at 9:37 AM, Kathleen Moriarty <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> 
>>

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 13 Oct 2016 10:54:02 -0400

On Thu, Oct 13, 2016 at 10:23 AM, Phil Hunt <[email-masked]> wrote:

> Hmm, I don't think that's clear enough.  Can you expand on it a bit?

Thanks,
Kathleen

>> Maybe I am reading the charter wrong. But the charter should indicate
>> that we will develop one secure transport based on HTTP POST.
>>
>

-- 

Best regards,
Kathleen

---

From: Phil Hunt <[email-masked]>
Date: Thu, 13 Oct 2016 11:03:03 -0400

Kathleen,

My apologies. I wonder if you, Stephen and I, are all in different places on transport.  :)

If it helps, here is the distribution draft I was going to propose for consideration in Seoul that covers this:
https://tools.ietf.org/html/draft-hunt-idevent-distribution-01

I understand if that it too much detail.

Phil

@independentid

> On Oct 13, 2016, at 10:54 AM, Kathleen Moriarty <[email-masked]> wrote:
> 
> 
> 
> On Thu, Oct 13, 2016 at 10:23 AM, Phil Hunt <[email-masked] <mailto:[email-masked]>> wrote:
>> On Oct 13, 2016, at 10:07 AM, Kathleen Moriarty <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Hi Phil,
>>