Subject: Re: [jose] WGLC for draft-ietf-jose-crfg-curves

From: "Matt Miller (mamille2)" <[email-masked]>
Date: Tue, 5 Jul 2016 23:41:37 +0000

My apologies for the tardiness of these last call comments.

Overall, I think draft-ietf-jose-cfrg-curves-03 needs a little more
editorial work before it is ready to be published.

* It seems odd that RFC7515 and RFC7516 are not referenced at all.
It seems appropriate to at least informatively reference that the
signature portion of this document relates to RFC7515 and the ECDH
portion relate to RFC7516.  However, I think at least RFC7515 needs
to be a normative reference; I don't think someone can implement
the signing/verifying portions of this document without knowing
what "JWS Signing Input" means (see bullet #N).

* It seems odd that RFC7517, RFC7518, and RFC7638 are informative
references rather than normative.  I'm especially not sure one can
implement the ECDH portion of this document without understanding
at least RFC 7518 § 4.6.

* This document is using terms from RFC7515, RFC7517, and RFC7518,
yet this is not mentioned at all.  It seems to me § 1.1 ought to
state this document is using terms from those documents.

--
- m&m

Matt Miller
Cisco Systems, Inc.

> On Jun 10, 2016, at 18:07, Jim Schaad <[email-masked]> wrote:
> 
> I have not seen any reviews yet except mine.  Part of the reason why this
> work is being done in the JOSE working group is because we have a better
> understanding of how it should work in JOSE.  If we get to the end of the
> last call and there are not "a sufficient number" reviews, I will talk with
> the AD about bouncing it to the CURDLE working group for completion.
> 
> Jim
> 
> 
>> -----Original Message-----
>> From: jose [mailto:[email-masked]] On Behalf Of Jim Schaad
>> Sent: Friday, June 03, 2016 8:06 AM
>> To: [email-masked]
>> Subject: [jose] WGLC for draft-ietf-jose-crfg-curves
>> 
>> This starts a (roughly) two-week last call on this document.
>> 
>> Last call will end on 20 June.  Please read the document and give comments
>> even if it is as simple as "I did not see any problems with this draft".
>> 
>> Thanks
>> 
>> Jim
>> 
>> 
>> _______________________________________________
>> jose mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/jose
> 
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: Mike Jones <[email-masked]>
Date: Tue, 5 Jul 2016 23:42:42 +0000

+1 to these comments

-----Original Message-----
From: jose [mailto:[email-masked]] On Behalf Of Matt Miller (mamille2)
Sent: Tuesday, July 5, 2016 4:42 PM
To: [email-masked]
Subject: Re: [jose] WGLC for draft-ietf-jose-crfg-curves

Overall, I think draft-ietf-jose-cfrg-curves-03 needs a little more editorial work before it is ready to be published.

* It seems odd that RFC7515 and RFC7516 are not referenced at all.
It seems appropriate to at least informatively reference that the signature portion of this document relates to RFC7515 and the ECDH portion relate to RFC7516.  However, I think at least RFC7515 needs to be a normative reference; I don't think someone can implement the signing/verifying portions of this document without knowing what "JWS Signing Input" means (see bullet #N).

* It seems odd that RFC7517, RFC7518, and RFC7638 are informative references rather than normative.  I'm especially not sure one can implement the ECDH portion of this document without understanding at least RFC 7518 § 4.6.

* This document is using terms from RFC7515, RFC7517, and RFC7518, yet this is not mentioned at all.  It seems to me § 1.1 ought to state this document is using terms from those documents.

--
- m&m

Matt Miller
Cisco Systems, Inc.

> I have not seen any reviews yet except mine.  Part of the reason why 
> this work is being done in the JOSE working group is because we have a 
> better understanding of how it should work in JOSE.  If we get to the 
> end of the last call and there are not "a sufficient number" reviews, 
> I will talk with the AD about bouncing it to the CURDLE working group for completion.
> 
> Jim
> 
> 
>> Last call will end on 20 June.  Please read the document and give 
>> comments even if it is as simple as "I did not see any problems with this draft".
>> 
>> Thanks
>> 
>> Jim
>> 
>>

---

From: Ilari Liusvaara <[email-masked]>
Date: Wed, 6 Jul 2016 09:52:38 +0300

> editorial work before it is ready to be published.

<Some comments about references>

I tried to address these comments in Editor's Copy. Will push out a
new draft probably today (I know about the cutoff coming in a
few days).

-Ilari

---

From: "Matt Miller (mamille2)" <[email-masked]>
Date: Wed, 6 Jul 2016 15:26:44 +0000

If you're using GitHub for this doc and can send me a link, I can take an early look and try to send a PR if that helps.

--
- m&m

Matt Miller
Cisco Systems, Inc.

> On Jul 6, 2016, at 00:52, Ilari Liusvaara <[email-masked]> wrote:
>