Subject: [Gen-art] Gen-ART LC review of draft-ietf-jose-json-web-algorithms-31

From: "Roni Even" <[email-masked]>
Date: Mon, 1 Sep 2014 14:46:49 +0300

I am the assigned Gen-ART reviewer for this draft. For background on
Gen-ART, please see the FAQ at
<http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>.

Please resolve these comments along with any other Last Call comments you
may receive.

Document:  draft-ietf-jose-json-web-algorithms-31

Reviewer: Roni Even

Review Date:2014-9-1

IETF LC End Date: 2014-9-3

IESG Telechat date: 

Summary: This draft is ready for publication as a standard track RFC.

Major issues:

Minor issues:

Nits/editorial comments:

1.	Section 4.8 "This section defines the specifies" should be
"specifics"
2.	Section 5.2.2 "Section 5.2.3 and Section 5.2.5" should be "through"
since 5.2.4 also defines instances.
3.	Section 5.2.2.1 in bullet 1 "the values of these parameters are
specified by the AEAD algorithms (in Section 5.2.3 and Section 5.2.5)". Did
you mean AEAD in which case is should be expanded and a reference is
probably needed or do you need to change it to Authenticated Encryption?
Also the "and" should be "through" same as previous comment.
4.	In section 5.2.2.1 bullet 4 for "number of bits in A" I had to go to
bullet 5 to see what A is. Maybe add also here "additional authenticated
data"

---

From: Mike Jones <[email-masked]>
Date: Thu, 4 Sep 2014 19:30:57 +0000

Thanks for the review, Roni.  I'm also cc'ing the working group so they're aware of your review.  Replies are inline below...

From: Roni Even [mailto:[email-masked]]
Sent: Monday, September 01, 2014 4:47 AM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Gen-ART LC review of draft-ietf-jose-json-web-algorithms-31

I am the assigned Gen-ART reviewer for this draft. For background on Gen-ART, please see the FAQ at <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>.
Please resolve these comments along with any other Last Call comments you may receive.

Reviewer: Roni Even

Review Date:2014-9-1

IESG Telechat date:

Major issues:

Minor issues:

Nits/editorial comments:

  1.  Section 4.8 "This section defines the specifies" should be "specifics"

Thanks

  1.  Section 5.2.2 "Section 5.2.3 and Section 5.2.5" should be "through" since 5.2.4 also defines instances.

Agreed

  1.  Section 5.2.2.1 in bullet 1 "the values of these parameters are specified by the AEAD algorithms (in Section 5.2.3 and Section 5.2.5)". Did you mean AEAD in which case is should be expanded and a reference is probably needed or do you need to change it to Authenticated Encryption? Also the "and" should be "through" same as previous comment.

Yes, the "AEAD" should become "Authenticated Encryption" to be consistent with the rest of the spec.  And agreed about "through".

  1.  In section 5.2.2.1 bullet 4 for "number of bits in A" I had to go to bullet 5 to see what A is. Maybe add also here "additional authenticated data"

"A" is defined in the first sentence of 5.2.2.1 as "additional authenticated data".  But there would be no harm the addition you propose.  Knowing that it's defined in the first sentence, do you still want to see the addition?

                                                                Thanks again,
                                                                -- Mike

---

From: "Roni Even" <[email-masked]>
Date: Fri, 5 Sep 2014 00:40:46 +0300

Hi Mike,

Inline

Roni

From: Mike Jones [mailto:[email-masked]] 
Sent: 04 September, 2014 10:31 PM
To: Roni Even; [email-masked];
[email-masked]
Cc: [email-masked]; [email-masked]
Subject: RE: Gen-ART LC review of draft-ietf-jose-json-web-algorithms-31

Thanks for the review, Roni.  I'm also cc'ing the working group so they're
aware of your review.  Replies are inline below.

Reviewer: Roni Even

Review Date:2014-9-1

IESG Telechat date: 

 

Major issues:

Minor issues:

Nits/editorial comments:

Thanks

Agreed

Yes, the "AEAD" should become "Authenticated Encryption" to be consistent
with the rest of the spec.  And agreed about "through".

"A" is defined in the first sentence of 5.2.2.1 as "additional authenticated
data".  But there would be no harm the addition you propose.  Knowing that
it's defined in the first sentence, do you still want to see the addition?

[Roni Even] I think it will be good to have the definition  so  it is
consistent with bullet 5

                                                                Thanks
again,

                                                                -- Mike

---

From: Mike Jones <[email-masked]>
Date: Tue, 23 Sep 2014 23:17:30 +0000

Thanks again for your review, Roni.  The resolutions discussed below have been applied in the -32 draft.

                                                                -- Mike

From: Roni Even [mailto:[email-masked]]
Sent: Thursday, September 04, 2014 2:41 PM
To: Mike Jones; [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]
Subject: RE: Gen-ART LC review of draft-ietf-jose-json-web-algorithms-31

Hi Mike,
Inline
Roni

From: Mike Jones [mailto:[email-masked]]
Sent: 04 September, 2014 10:31 PM
To: Roni Even; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: RE: Gen-ART LC review of draft-ietf-jose-json-web-algorithms-31

From: Roni Even [mailto:[email-masked]]
Sent: Monday, September 01, 2014 4:47 AM
To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Gen-ART LC review of draft-ietf-jose-json-web-algorithms-31

Reviewer: Roni Even

Review Date:2014-9-1

IESG Telechat date:

Major issues:

Minor issues:

Nits/editorial comments:

Thanks

Agreed

"A" is defined in the first sentence of 5.2.2.1 as "additional authenticated data".  But there would be no harm the addition you propose.  Knowing that it's defined in the first sentence, do you still want to see the addition?
[Roni Even] I think it will be good to have the definition  so  it is consistent with bullet 5

                                                                Thanks again,
                                                                -- Mike