Subject: [Anima] Questions open after Last Call review of GRASP

From: Brian E Carpenter <[email-masked]>
Date: Sun, 5 Mar 2017 15:51:02 +1300

Hi,

We got two excellent reviews of draft-ietf-anima-grasp-09
from Joel Halpern and Charlie Perkins. In fact the WG owes
Charlie a big round of applause for the thoroughness of his
review.

Of course, the authors will fix all the issues that are
mistakes, omissions, or lack of clarity. We will get
a -10 draft out before the deadline, which we hope people
can check before the IETF.

There are three larger issues where WG or WG Chair or AD
input is needed:

1. Normative dependency on a draft.

We use CDDL, which is still far from being a published
standards track RFC (draft-greevenbosch-appsawg-cbor-cddl).
This could hold up the GRASP RFC indefinitely.

Proposed resolution: add an appendix specifying only
the subset of CDDL we need. This has already been drafted
so is quite feasible to do quickly.

- Split the document? [Charlie Perkins]

"parts of the document seem more philosophical than
prescriptive... It should be considered to break the document
into a Requirements document and a more rigorously defined
protocol solution document."

Proposed resolution: writing a separate requirements document
was essentially excluded when the WG was chartered. Unless the
WG and AD want to backtrack on that, the proposed resolution
is to *not* do this. Of course, all the specific review comments
about non-rigorous text will be actioned.

- Clarify security [Charlie Perkins]

"In some
places, ACP seems to be mandated, and in other places that is relaxed
to mean "a sufficient security mechanism".  It would be better to
identify the security requirements, and put them unmistakably in the
Security Considerations section, which deserves to have teeth."

(and various detailed comments in the text)

Of course we will deal with the detailed comments and fix the
inconsistencies. The larger issue is whether we should move most
of the security discussion to the Security Considerations section.

Speaking only for myself, I think it would be a mistake, because
at the moment it seems to me that the security issues are
mentioned where they most logically fit.

Proposed resolution: TBD

   Brian (as co-editor of the draft)

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 7 Mar 2017 10:23:43 +1300

Replying to myself, I have added a note to the first issue.

> so is quite feasible to do quickly.

Note: since we have other normative dependencies on drafts,
we could delay this change until later.