Subject: [Id-event] Mirja Kühlewind's No Record on draft-ietf-secevent-token-10: (with COMMENT)

From: Mirja Kühlewind <[email-masked]>
Date: Mon, 07 May 2018 05:02:41 -0700

Mirja Kühlewind has entered the following ballot position for
draft-ietf-secevent-token-10: No Record

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-secevent-token/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I guess this doc could also be informational as it "only" specifies a SET data
structure and specific profiles will be defined in other documents that I guess
would/could/should be stand-alone and as such might only need to refer this doc
informatively. Was the intended state discussed in the working group?

Minor question/comment:
sec  6: "SET issuers SHOULD take steps to minimize the chance of event
correlation, when such correlation would constitute a privacy violation."
Should this maybe be a MUST given there is a constraint already given?

---

From: Mike Jones <[email-masked]>
Date: Mon, 7 May 2018 16:26:47 +0000

Thanks for your comments, Mirja.  My replies are inline below, prefixed by "Mike>".

-----Original Message-----
From: Mirja Kühlewind <[email-masked]> 
Sent: Monday, May 7, 2018 5:03 AM
To: The IESG <[email-masked]>
Cc: [email-masked]; Yaron Sheffer <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Subject: Mirja Kühlewind's No Record on draft-ietf-secevent-token-10: (with COMMENT)

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)

I guess this doc could also be informational as it "only" specifies a SET data structure and specific profiles will be defined in other documents that I guess would/could/should be stand-alone and as such might only need to refer this doc informatively. Was the intended state discussed in the working group?

Mike> The document is standards-track because it imposes normative requirements on all SET implementations.  For instance, it defines the "events" claim and specifies how it is used.

Minor question/comment:
sec  6: "SET issuers SHOULD take steps to minimize the chance of event correlation, when such correlation would constitute a privacy violation."
Should this maybe be a MUST given there is a constraint already given?

Mike> I believe it would be in the realm of the profiling specifications to make this a "MUST" if appropriate for the use case.  Given SETs can be profiled for many different kinds of use cases, I'm worried that making this a "MUST" in the base SET specification might be the wrong choice for some use cases. 

				Thanks again,
				-- Mike

---

From: Phil Hunt <[email-masked]>
Date: Mon, 7 May 2018 10:05:09 -0700

Mirja,

Thanks for your questions.

Just to add to Mike’s comments, the spec follows similar normative pattern as the JWT (RFC7519) spec that it extends.

While the draft talks about profiles there is an expectation that informal profiles will be developed between specific parties in just the same way as JWT tokens may be locally defined between parties. 

There is significant other normative rules clarifying use of JWT claims as well as defining other new claims (e.g. toe and txn). The spec also helps define disambiguation of SETs from other token types as well as other key security considerations that arise from the class of use. 

Hope this helps.

Phil

Oracle Corporation, Identity Cloud Services Architect
@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On May 7, 2018, at 9:26 AM, Mike Jones <[email-masked]> wrote:
>

---

From: "Mirja Kuehlewind (IETF)" <[email-masked]>
Date: Mon, 7 May 2018 21:00:35 +0200

Hi Mike

> Am 07.05.2018 um 18:26 schrieb Mike Jones <[email-masked]>:
> 

Informational document can also have normative claims. 

Mirja

---

From: "Mirja Kuehlewind (IETF)" <[email-masked]>
Date: Mon, 7 May 2018 21:00:50 +0200

Okay. Thanks for the background info!

> Am 07.05.2018 um 19:05 schrieb Phil Hunt <[email-masked]>:
> 
> Mirja,
> 
> www.independentid.com
> [email-masked]