Subject: [Ace] [ace] WGLC on draft-ietf-ace-cbor-web-token

From: "Kepeng Li" <[email-masked]>
Date: Fri, 21 Apr 2017 05:52:49 +0800

In Chicago, it was decided that we were going to WGLC the ACE CBOR Web
Token draft.

So this starts a working group last call for draft-ietf-ace-cbor-web-token
for submission as a Standards Track RFC, ending on 24:00 PDT on Tuesday,
May 2, 2017.

The specification is available at:
https://tools.ietf.org/html/draft-ietf-ace-cbor-web-token-04

An HTML-formatted version is also available at:
http://self-issued.info/docs/draft-ietf-ace-cbor-web-token-04.html

Thanks,

Kind Regards
Kepeng & Hannes

---

From: Jim Schaad <[email-masked]>
Date: Sat, 22 Apr 2017 11:47:13 -0700

Not ready to ship.

* I find the text for NumericDate confusing and would suggest this is a
cleaner wording.

The "NumericDate" term has the same meaning, syntax and
Processing rules as the "NumericDate" term defined in Section 2 of
JWT [RFC7519], except that the CBOR numeric representation
(Section 2.4.1 of [RC7049]) is used.  The encoding is modified so that
the leading tag (6.1 or 0xC1) MUST be omitted.

<Note above text kills the direct need for section 5.>

* What is a "CWT NumericDate" ?  Why is this not just a "NumericDate"?  You
should be consistent on how you are using this and the "StringOrURI" type
identifier.  Either use the CWT prefix or don't.

* s/except that a CWT StringOrURI/except that for a CWT, StringOrURI/

* The algorithm for doing nesting detection is a gross abuse of the content
type parameter and can be far more easily done based on the already present
tagging of the COSE object.

* Break section 8 into multiple paragraphs that deal with different types of
issues.

* In section 8, the first sentence implies to me that you believe that COSE
is more of a problem that breaking of cryptographic algorithms, trust of
certificates/keys.  Not sure what needs to be done, but better clarity may
be a good idea.

* I have not done any validation of the examples.   You might want to have
an example which uses the real for one of the time types.

Jim

-----Original Message-----
From: Ace [mailto:[email-masked]] On Behalf Of Kepeng Li
Sent: Thursday, April 20, 2017 2:53 PM
To: [email-masked]
Cc: Hannes Tschofenig <[email-masked]>
Subject: [Ace] [ace] WGLC on draft-ietf-ace-cbor-web-token

In Chicago, it was decided that we were going to WGLC the ACE CBOR Web Token
draft.

So this starts a working group last call for draft-ietf-ace-cbor-web-token
for submission as a Standards Track RFC, ending on 24:00 PDT on Tuesday, May
2, 2017.

Thanks,

Kind Regards
Kepeng & Hannes

_______________________________________________
Ace mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ace