Subject: [Id-event] Alissa Cooper's No Objection on draft-ietf-secevent-token-11: (with COMMENT)

From: Alissa Cooper <[email-masked]>
Date: Wed, 09 May 2018 12:30:20 -0700

Alissa Cooper has entered the following ballot position for
draft-ietf-secevent-token-11: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-secevent-token/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

= Sec. 5.1 =

"Security events distributed through third parties or that carry
   personally identifiable information SHOULD be encrypted using JWE
   [RFC7516] or secured for confidentiality by other means."

The SHOULD here seems like it should be a MUST unless there are obvious exception cases.

= Sec. 5.2 =

"In
   addition to confidentiality and integrity (discussed above),
   implementers and profiling specifications MUST consider the
   consequences of delivery mechanisms that are not secure and/or not
   assured."

The "implementers ... MUST consider" construction seems like an odd use of normative language.

---

From: Phil Hunt <[email-masked]>
Date: Wed, 9 May 2018 15:06:00 -0700

Alissa,

Thanks for the comments. I will apply them in draft 12. 

Cheers,

Phil

> On May 9, 2018, at 12:30 PM, Alissa Cooper <[email-masked]> wrote:
> 
> Please refer to https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_iesg_statement_discuss-2Dcriteria.html&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=95fIBcwc6yxsWmW8TNIRDyen0OFdCfQtVvsCvKglxMQ&s=yuXqSMMhZSFnEliz1LpgHr4-6AVMlwMYg4hGPfUV_VI&e=
> https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=95fIBcwc6yxsWmW8TNIRDyen0OFdCfQtVvsCvKglxMQ&s=NXgUokg6RBO_Hy_uEx4k1CEjdsnMAJzHql9xQ0wKp9E&e=
> 
> 
> 
> _______________________________________________
> Id-event mailing list
> [email-masked]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=95fIBcwc6yxsWmW8TNIRDyen0OFdCfQtVvsCvKglxMQ&s=tYI2_anKOqEnJ4NeoeMuFe4ezRHvI5d--_8CfEdSx74&e=

---

From: Phil Hunt <[email-masked]>
Date: Wed, 9 May 2018 16:25:24 -0700

Alissa,

Your feedback is now posted in draft 12. 

Thanks again,

Phil

Oracle Corporation, Identity Cloud Services Architect
@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

---

From: Alissa Cooper <[email-masked]>
Date: Wed, 9 May 2018 20:43:57 -0400

Thanks!

> On May 9, 2018, at 7:25 PM, Phil Hunt <[email-masked]> wrote:
> 
> Alissa,
> 
>> On May 9, 2018, at 12:30 PM, Alissa Cooper <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html <https://www.ietf.org/iesg/statement/discuss-criteria.html>
>> https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ <https://datatracker.ietf.org/doc/draft-ietf-secevent-token/>
>> 
>> 
>>