Subject: [Ace] Lars Eggert's No Objection on draft-ietf-ace-mqtt-tls-profile-15: (with COMMENT)

From: Lars Eggert via Datatracker <[email-masked]>
Date: Mon, 07 Mar 2022 01:31:25 -0800

Lars Eggert has entered the following ballot position for
draft-ietf-ace-mqtt-tls-profile-15: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Found terminology that should be reviewed for inclusivity; see
https://www.rfc-editor.org/part2/#inclusive_language for background and more
guidance:

 * Term "master"; alternatives might be "active", "central", "initiator",
   "leader", "main", "orchestrator", "parent", "primary", "server".

 * Term "his"; alternatives might be "they", "them", "their".

 * Term "invalid"; alternatives might be "not valid", "unenforceable", "not
   binding", "inoperative", "illegitimate", "incorrect", "improper",
   "unacceptable", "inapplicable", "revoked", "rescinded".

Thanks to Theresa Enghardt for their General Area Review Team (Gen-ART) review
(https://mailarchive.ietf.org/arch/msg/gen-art/-D0Fe7Px8IRU5yIFmngv6SR420c).

-------------------------------------------------------------------------------
All comments below are about very minor potential issues that you may choose to
address in some way - or ignore - as you see fit. Some were flagged by
automated tools (via https://github.com/larseggert/ietf-reviewtool), so there
will likely be some false positives. There is no need to let me know what you
did with these suggestions.

Section 2.1. , paragraph 5, nit:
>    This document follows [RFC7800] for PoP semantics for JWTs (CWTs can
>    also be used).  The PoP token includes a 'cnf' parameter with a

s/can/MAY/ ?

Section 2.2.2. , paragraph 4, nit:
-    DISCONNECT packet as explained below.
+    DISCONNECT packet, as explained below.
+                     +

Section 2. , paragraph 4, nit:
> e RPK case is handled as described in in Section 3.2.1 of the DTLS profile [
>                                    ^^^^^
Possible typo: you repeated a word.

Section 2.2.1. , paragraph 2, nit:
> lient MUST validate a public key from a X.509 certificate or an RPK from the
>                                       ^
Use "an" instead of "a" if the following word starts with a vowel sound, e.g.
"an article", "an hour".

Section 2.2.1. , paragraph 7, nit:
>  equal to 0, and the token is invalid or the claims cannot be obtained in the
>                                      ^^^
Use a comma before "or" if it connects two independent clauses (unless they are
closely connected and short).

Section 2.2.3. , paragraph 2, nit:
> to an earlier proposal by Fremantle et al [fremantle14]. After sending the C
>                                     ^^^^^
A period is misplaced or missing.

Section 2.2.4.2. , paragraph 3, nit:
>  as shown in Figure 7 and includes the the 8-byte Client nonce, and the signa
>                                    ^^^^^^^
Possible typo: you repeated a word.

Section 2.2.5. , paragraph 3, nit:
> ame or filter in question is either an an exact match to or a subset of at le
>                                     ^^^^^
Possible typo: you repeated a word.

Section 2.4.1. , paragraph 3, nit:
> est for topic "a/b/*", and has a token token permits "a/*", this is a valid s
>                                  ^^^^^^^^^^^
Possible typo: you repeated a word.

Section 10.1. , paragraph 23, nit:
>  broker. * Added a statement that the the broker will disconnect on almost an
>                                   ^^^^^^^
Possible typo: you repeated a word.

Uncited references:
     [I-D.ietf-ace-oauth-params], [RFC8422], [RFC7251], and [RFC8705].

Document references draft-ietf-ace-aif-05, but -06 is the latest available
revision.

Document references draft-ietf-ace-pubsub-profile-01, but -04 is the latest
available revision.

These URLs in the document did not return content:
 * http://www.ietf.org/internet-drafts/draft-ietf-ace-pubsub-profile-01.txt

These URLs in the document can probably be converted to HTTPS:
 * http://docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html
 * http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/mqtt-v3.1.1.html
 * http://dx.doi.org/10.1109/SIoT.2014.8

---

From: Cigdem Sengul <[email-masked]>
Date: Thu, 10 Mar 2022 00:27:49 +0000

Dear Lars,

Thank you very much for your comments - I especially appreciated the nudge
for inclusive language and tried to address them as best as I could.
I know it was stated that there was no need to inform changes, but let me
share the PR
<https://github.com/ace-wg/mqtt-tls-profile/pull/103/commits/dda6515a9bdae22b3228e3e62c2097c5c6cd7ea2>
 still.
Explanations of fixes/comments if left unchanged are also inline.
Kind regards,
--Cigdem

On Mon, 7 Mar 2022 at 09:31, Lars Eggert via Datatracker <[email-masked]>
wrote:

> Please refer to
> https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/

[CS:  I would like to indeed avoid this work, but it appears as a result of
using "Extended Master Secret".
 Has this been replaced with an alternative?]

>  * Term "his"; alternatives might be "they", "them", "their".
[CS: The word appears in acknowledgements to thank specific people;
however, happy to change it to their pronouns,
if "his" doesn't apply.]

>    "unacceptable", "inapplicable", "revoked", "rescinded".

[CS: Fixed except in two places where the word appears as part of a
standard MQTT error response.]

> (https://mailarchive.ietf.org/arch/msg/gen-art/-D0Fe7Px8IRU5yIFmngv6SR420c
[CS: Fixed.]

> +    DISCONNECT packet, as explained below.

[CS: The problematic text no longer exists]

> Possible typo: you repeated a word.
[CS: Fixed.]

> Use "an" instead of "a" if the following word starts with a vowel sound,
[CS: Looks correct, kept as is.]

> closely connected and short).
 [CS: Looks correct, kept as is.]

> A period is misplaced or missing.
[CS: Looks correct, kept as is.]

> Possible typo: you repeated a word.
[CS: fixed]

> Possible typo: you repeated a word.
 [CS: The problematic text no longer exists]

> Possible typo: you repeated a word.
[CS: The problematic text no longer exists]

> Possible typo: you repeated a word.
 [CS: The problematic text no longer exists]

>      [I-D.ietf-ace-oauth-params], [RFC8422], [RFC7251], and [RFC8705].
[CS: Fixed in artart review]

> Document references draft-ietf-ace-aif-05, but -06 is the latest available
[CS: Fixed.]

> Document references draft-ietf-ace-pubsub-profile-01, but -04 is the latest
 [CS: Fixed in artart review]

>  *
> http://www.ietf.org/internet-drafts/draft-ietf-ace-pubsub-profile-01.txt

[CS: version 04 does]

>  * http://dx.doi.org/10.1109/SIoT.2014.8

[CS: Done]

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 14 Mar 2022 17:14:42 -0700

>  Has this been replaced with an alternative?]

It looks like it's in the process of being renamed to
"extended_main_secret" (per draft-ietf-tls-rfc8446bis, work-in-progress).

-Ben