Subject: [OAUTH-WG] Secdir last call review of draft-ietf-oauth-iss-auth-resp-02

From: Yoav Nir via Datatracker <[email-masked]>
Date: Sat, 06 Nov 2021 15:06:50 -0700

Reviewer: Yoav Nir
Review result: Ready

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area directors.
 Document editors and WG chairs should treat these comments just like any other
last call comments.

The draft is clear and well-written. The Security Considerations section
specifically is comprehensive and clear.

My one suggestion would be to move the first paragraph in the Security
Considerations section to the Introduction. It is about the attack and about
the protocol in the document being effective against the attack. It's not
really a consideration in the way that the rest of the section is.

---

From: Karsten Meyer zu Selhausen <[email-masked]>
Date: Mon, 15 Nov 2021 15:59:59 +0100

Hi Yoav,

thank you for your suggestion. We think its a valid point and followed 
it in a local branch.

Best regards,
Karsten

-- 
Karsten Meyer zu Selhausen
Senior IT Security Consultant
Phone:	+49 (0)234 / 54456499
Web:	https://hackmanit.de  | IT Security Consulting, Penetration Testing, Security Training

Is your OAuth or OpenID Connect application vulnerable to mix-up attacks? Find out more on our blog:
https://www.hackmanit.de/en/blog-en/132-how-to-protect-your-oauth-client-against-mix-up-attacks

Hackmanit GmbH
Universitätsstraße 60 (Exzenterhaus)
44789 Bochum

Registergericht: Amtsgericht Bochum, HRB 14896
Geschäftsführer: Prof. Dr. Jörg Schwenk, Prof. Dr. Juraj Somorovsky, Dr. Christian Mainka, Prof. Dr. Marcus Niemietz