Subject: Re: [Ace] Francesca Palombini's Yes on draft-ietf-ace-dtls-authorize-16: (with COMMENT)

From: Francesca Palombini <[email-masked]>
Date: Tue, 8 Jun 2021 09:33:28 +0000

Hi Olaf, Steffi,

My turn to apologize for the late reply :) I went through the comment again and I believe I must have misread something. I am ok with the current text, or the previous one as well, if you'd rather not add this sentence.

I do have one additional comment, which came out while looking this over again - about the following text:

   correct public key in the DTLS handshake.  If the authorization
   server has specified a "cnf" field in the access token response, the
   client MUST use this key.  Otherwise, the client MUST use the public

The access token is opaque to the client (as defined the ace framework), so the client is not necessarily able to read and extract the key it is supposed to use from it. If I am not mistaken, the correct way for the AS to tell the client what key to use would be to use the "cnf" field defined in Section 3.2 of oauth-params.

Francesca

On 27/05/2021, 13:25, "Olaf Bergmann" <[email-masked]> wrote:

    Hi Francesca,

    Did you have chance to take another look at comment #3 of your review
    (see below)?

    Grüße
    Olaf

    On 2021-05-11, Stefanie Gerdes <[email-masked]> wrote:

    >
    > On 3/24/21 4:49 PM, Francesca Palombini via Datatracker wrote:
    >> 
    >> ----------------------------------------------------------------------
    >> COMMENT:
    >> ----------------------------------------------------------------------
    >> 
    >> 3. ------
    >> 
    >>    raw public keys, it needs to determine which key to use.  The
    >>    authorization server can help with this decision by including a "cnf"
    >>    parameter in the access token that is associated with this
    >>    communication.  In this case, the resource server MUST use the
    >> 
    >> FP: The example in Figure 4 show how the whole RPK of the client can be
    >> included in the access_token, so maybe this paragraph should cover that case,
    >> or the example changed.
    >
    > I am not quite sure if I understand your comment. In Figure 4, the
    > contents of the access token is omitted for brevity. The response
    > contains access information for the client with the server's RPK in
    > the rs_cnf parameter. This is required by the client to authenticate
    > its peer during the DTLS handshake. We changed the example paragraph
    > so that it now explains the use of the rs_cnf parameter. Does that
    > make it more clear?

    The new text we have included reads:

    "The response comprises access information for the client that contains
    the server's public key in the rs_cnf parameter."

---

From: Olaf Bergmann <[email-masked]>
Date: Tue, 08 Jun 2021 11:59:06 +0200

Hi Francesca,

On 2021-06-08, Francesca Palombini <[email-masked]> wrote:

> My turn to apologize for the late reply :) I went through the comment
> again and I believe I must have misread something. I am ok with the
> current text, or the previous one as well, if you'd rather not add
> this sentence.

Thanks for the followup — we have kept the new text in version -18.

> The access token is opaque to the client (as defined the ace
> framework), so the client is not necessarily able to read and extract
> the key it is supposed to use from it. If I am not mistaken, the
> correct way for the AS to tell the client what key to use would be to
> use the "cnf" field defined in Section 3.2 of oauth-params.

You are correct. That is basically what this text says (= if the AS has
provided the cnf in its response, the client has to use it).

Grüße
Olaf

---

From: Francesca Palombini <[email-masked]>
Date: Tue, 8 Jun 2021 10:06:17 +0000

Hi Olaf,

Right! Somehow I managed to miss the « response » from the « access token response ».

Thanks for the answers, it all looks good to me and ready to ship.

Francesca

On 8 June 2021 at 11:59:19 CEST, Olaf Bergmann <[email-masked]> wrote:
Hi Francesca,

Grüße
Olaf

---

From: Daniel Migault <[email-masked]>
Date: Tue, 8 Jun 2021 12:10:04 +0000

Great!
Thanks Olaf for addressing the comments and moving the document forward!

Yours,
Daniel
________________________________
From: Francesca Palombini <[email-masked]>
Sent: Tuesday, June 8, 2021 6:06 AM
To: Olaf Bergmann <[email-masked]>
Cc: Stefanie Gerdes <[email-masked]>; The IESG <[email-masked]>; [email-masked] <[email-masked]>; [email-masked] <[email-masked]>; [email-masked] <[email-masked]>
Subject: Re: Francesca Palombini's Yes on draft-ietf-ace-dtls-authorize-16: (with COMMENT)

Hi Olaf,

Francesca

Grüße
Olaf