Subject: Re: [OAUTH-WG] Alexey Melnikov's No Objection on draft-ietf-oauth-device-flow-11: (with COMMENT)

From: William Denniss <[email-masked]>
Date: Thu, 2 Aug 2018 11:18:57 -0700

Alexey,

Thank you for your feedback. Replies inline:

On Sun, Jul 29, 2018 at 9:26 AM, Alexey Melnikov <[email-masked]>
wrote:

>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> This is generally a fine document and it was easy to follow.
>
> I am agreeing with Benjamin's DISCUSS about amount of entropy in codes.
>

Understood, we are working on this.

>
> In addition, the last para in Section 6.1 reads:
>
>    The server should ignore any characters like punctuation that are not
>    in the user-code character set.  Provided that the character set
>    doesn't include characters of different case, the comparison should
>    be case insensitive.
>
> This makes me uncomfortable, because you are talking of case-insensitivity,
> without fully specifying what it is. I assume that your advice only
> applies to user-code character sets which only use subset of ASCII?
> Because if you mean to extend your advice to full Unicode, you need more
> text
> and references here. Can you please clarify.
>

Version -12 updates this section.  It now reads, in part:

   For codes using
   only characters in the A-Z range as with the base-20 charset defined
   above, the user's input should be upper-cased before comparison to
   account for the fact that the user may input the equivalent lower-
   case characters.

Best,
William

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 03 Aug 2018 10:17:08 +0100

Hi William,

On Thu, Aug 2, 2018, at 7:18 PM, William Denniss wrote:
> On Sun, Jul 29, 2018 at 9:26 AM, Alexey Melnikov
> <[email-masked]> wrote:>> 
>> ---------------------------------------------------------------
>> ------->>  COMMENT:
>>  ----------------------------------------------------------------
>>  ------>> 
>>  I am agreeing with Benjamin's DISCUSS about amount of entropy in
>>  codes.> 
>>     The server should ignore any characters like punctuation that are
>>     not>>     in the user-code character set.  Provided that the character set>>     doesn't include characters of different case, the comparison
>>     should>>     be case insensitive.
>> 
>>  This makes me uncomfortable, because you are talking of case-
>>  insensitivity,>>  without fully specifying what it is. I assume that your advice only>>  applies to user-code character sets which only use subset of ASCII?>>  Because if you mean to extend your advice to full Unicode, you need
>>  more text>>  and references here. Can you please clarify.
> 
>    For codes using only characters in the A-Z range as with the base-
>    20 charset defined above, the user's input should be upper-cased
>    before comparison to account for the fact that the user may input
>    the equivalent lower- case characters.
This is much better, thank you!