Subject: [Unbearable] A storm in a cup of tea (related to draft-ietf-tokbind-protocol-13)

From: Denis <[email-masked]>
Date: Sun, 19 Mar 2017 19:42:48 +0100

On February 27, I sent an email with the following topic: WGLC 3 on core 
documents.

    Comments on draft-ietf-tokbind-protocol-13 (The Token Binding
    Protocol Version 1.0)

    On page 14 within the Security Considerations section, I appreciate
    the fact that the following sentences have been added:

    *The Token Binding protocol does not prevent cooperating clients from*

    *sharing a bound token.A client could intentionally export a bound*

    *token with the corresponding Token Binding private key, or perform*

    *signatures using this key on behalf of another client.*

    However, these sentences have been placed inside section 7.1 which
    is called "Security Token Replay".
    This security consideration has nothing to do with "Security Token
    Replay" but with "Client collusion".

    Therefore, these sentences should be placed under a new section
    called: "7.2. Client collusion".

I was quite surprised to see that Leif Johansson reacted violently. He 
raised *a storm in a cup of tea*.

In any case, this threat does not belong to a subsection called 
"Security Token Replay" since there is no replay of any kind.

A separate section should be used to mention that attack.

*A spade should be called a spade*. Now, if Leif would like to call it 
differently, why not ?

For example, it could also be called "*Security Token Forwarding*"

Hence, up to now, I consider that this comment has not been solved to my 
satisfaction.

Denis

---

From: Leif Johansson <[email-masked]>
Date: Sun, 19 Mar 2017 20:32:05 +0100

> Hence, up to now, I consider that this comment has not been solved to my

I don't understand what, if any you want the chairs or the WG to do
based on this email.

	Cheers Leif

---

From: Benjamin Kaduk <[email-masked]>
Date: Sun, 19 Mar 2017 14:44:26 -0500

> I don't understand what, if any you want the chairs or the WG to do

I thought it was pretty clear that he wanted the new "client
collusion" section added to the document and content moved to it.

But, to add to your other message in the thread, we should be clear
that his satisfaction is not required for the document to move
forward.  The chairs have an obligation to consider faithfully any
potential issues that he raises (even if they were raised in a
repetitive and overbearing manner) and see them resolved or
dismissed with WG (rough) consensus, but his role is mostly limited
to raising potential issues and participating in WG consensus.  It
is possible for individual participants to not be part of the WG
consensus, and thus for documents to proceed over their objections.

-Ben

---

From: Leif Johansson <[email-masked]>
Date: Sun, 19 Mar 2017 21:54:14 +0100

> collusion" section added to the document and content moved to it.

Thank you for helping to clarify that Ben.

I encourage anyone who support this change to +1 Denis message.

	Cheers Leif