Subject: Re: [apps-discuss] Last Call: <draft-ietf-appsawg-authres-ptypes-registry-03.txt> (A Property Types Registry for the Authentication-Results Header Field) to Proposed Standard

From: S Moonesamy <[email-masked]>
Date: Mon, 13 Oct 2014 05:10:47 -0700

At 13:41 16-09-2014, The IESG wrote:
>The IESG has received a request from the Applications Area Working Group
>WG (appsawg) to consider the following document:
>- 'A Property Types Registry for the Authentication-Results Header Field'
>   <draft-ietf-appsawg-authres-ptypes-registry-03.txt> as Proposed
>Standard
>
>The IESG plans to make a decision in the next few weeks, and solicits
>final comments on this action. Please send substantive comments to the
>[email-masked] mailing lists by 2014-09-30. Exceptionally, comments may be

These are late comments.  I'll defer to Murray on what to do.

The "ptype" allows for information extracted by the body to be 
included in the Authentication-Results header field.  That goes well 
beyond conveying the results of a message authentication effort in a 
machine-readable format.  According to Section 1, it is because:

   "There has emerged a desire to report types of properties about
    a message through this mechanism."

It looks like the Authentication-Results header field is being used 
as a matter of convenience because it has already been specified and 
it is possible to extend the mechanism.  Why does the sort of 
information which will be conveyed within the administrative boundary 
have to be registered?  What should the Expert Review do for 
information which is conveyed outside the administrative boundary?

Regards,
S. Moonesamy

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 13 Oct 2014 11:06:53 -0700

On Mon, Oct 13, 2014 at 5:10 AM, S Moonesamy <[email-masked]> wrote:

> The "ptype" allows for information extracted by the body to be included in
> the Authentication-Results header field.  That goes well beyond conveying
> the results of a message authentication effort in a machine-readable
> format.  According to Section 1, it is because:
>
> It looks like the Authentication-Results header field is being used as a
> matter of convenience because it has already been specified and it is
> possible to extend the mechanism.  Why does the sort of information which
> will be conveyed within the administrative boundary have to be registered?
> What should the Expert Review do for information which is conveyed outside
> the administrative boundary?
>

That's an excellent point.  Unfortunately, your point is really more about
RFC7001 itself, which defined the "body" ptype, than it is about the guts
of this particular document, so I don't know what (if any) action is
appropriate here.  I don't think it qualifies as an erratum against RFC7001
either, other than as a reminder to deal with it if there's ever an
RFC7001bis.

There are ample protections against leaking information across ADMD
boundaries in RFC7001 itself.  The question then is really about what
happens when someone doesn't follow that advice.  But I seem to recall that
the Security Considerations in RFC7001 is already pretty thorough about
that.

-MSK

---

From: S Moonesamy <[email-masked]>
Date: Mon, 13 Oct 2014 11:15:50 -0700

Hi Murray,
At 11:06 13-10-2014, Murray S. Kucherawy wrote:
>That's an excellent point.  Unfortunately, your point is really more 
>about RFC7001 itself, which defined the "body" ptype, than it is 
>about the guts of this particular

Thanks for the feedback.

Regards,
S. Moonesamy