Subject: [Ace] Roman Danyliw's No Objection on draft-ietf-ace-aif-06: (with COMMENT)

From: Roman Danyliw via Datatracker <[email-masked]>
Date: Tue, 08 Mar 2022 17:36:14 -0800

Roman Danyliw has entered the following ballot position for
draft-ietf-ace-aif-06: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ace-aif/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

** Section 5.2.
   The registration policy is Specification required [RFC8126].  The
   designated expert will engage with the submitter to ascertain the
   requirements of this document are addressed.

To help the DE, is there a way to be clearer on what requirements need to be
satisfied?  Is it the bulleted list in the SecCons?   Section 4?

** Section 6. I was under the impression that AIF didn’t have an explicit
requirement to use CoAP. For example, draft-ietf-ace-mqtt-tls-profile appears
to use the information model but isn’t restricted to CoAP.  Therefore, is it
more accurate to say:

OLD
The security considerations of [RFC7252] apply

NEW
When AIF is used with CoAP, the security considerations of [RFC7252] apply.

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 10 Mar 2022 02:44:22 +0100

Hi Roman,

Thank you for your thoughts.

I’m currently collecting updates into https://github.com/cabo/ace-aif until the ID submission opens again.

> On 2022-03-09, at 02:36, Roman Danyliw via Datatracker <[email-masked]> wrote:
> 
[…]

DE instructions are good, but may be a bit tedious in this document.
I’m not sure the DE will be able to assess the level of quality to which the seccons bullets are realized (which is not only hard in general, but here also requires knowledge of the application context), so I reduced this to a more abstract formulation.  RFC 6838 also poses requirements on the names allocated, which probably should be further limited by some common-sense thinking.

Addressed in https://github.com/cabo/ace-aif/commit/18fe26e

> When AIF is used with CoAP, the security considerations of [RFC7252] apply.

It’s a bit more complicated, as Section 11.1 of those is applicable to many other configurations.

Fixed in https://github.com/cabo/ace-aif/commit/5e24927

Grüße, Carsten