Subject: [Gen-art] Gen-ART review of draft-ietf-tram-turn-third-party-authz-09

From: Christer Holmberg <[email-masked]>
Date: Fri, 13 Feb 2015 07:23:13 +0000

I am the assigned Gen-ART reviewer for this draft. For background on Gen-ART, please see the FAQ at <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>

Document:                         draft-ietf-tram-turn-third-party-authz-09.txt

Reviewer:                           Christer Holmberg

Review Date:                     13 February 2015

IETF LC End Date:             4 January 2015

IETF Telechat Date:         19 February 2015

Summary:        I see that there has been quite of bit of changes in the draft since the previously reviewed version (-08). However, most of my comments seem to have been addressed. But, I still have a few comments, most related to my comments on the previously reviewed version.

Major Issues: None

Minor Issues: None

Editorial nits: See below

-------------

Section 1:

Q1_2: Please add an OAuth reference on first occurrence.

-------------

Section 4:

Q4_2:  The section gives examples for the key establishment. I think you should make it clear that, when you say that the mechanism to use is outside the scope of the document, also should say the draft does not mandate any given mechanism.

Something like:

        "The procedure for establishment of the symmetric key is outside the scope of this
        specification, and this specification does not mandate support of any given mechanism.
        Sections 4.1.2, 4.1.2 and 4.1.3 show examples of mechanisms that can be used."

Section 4.1.2:

Q4-1-2_1: Please add a reference to JSON on first occurrence. I see that section 3 no longer mentions JSON.

Q4-1-2_2: I suggest to add a reference to [I-D.ietf-oauth-pop-key-distribution] also in this section, and indicate that it defines the format of the JSON message.

-------------

Regards,

Christer

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Fri, 13 Feb 2015 14:28:23 +0000

Hi Christer,

Please see inline

From: Christer Holmberg [mailto:[email-masked]]
Sent: Friday, February 13, 2015 12:53 PM
To: [email-masked]
Cc: [email-masked]
Subject: Gen-ART review of draft-ietf-tram-turn-third-party-authz-09

Major Issues: None

Minor Issues: None

-------------

Section 1:

[TR] The latest version http://tools.ietf.org/html/draft-ietf-tram-turn-third-party-authz-11 has OAuth reference on first occurrence in the Introduction section.

-------------

Section 4:

[TR] Yes.

Something like:

[TR] Updated draft with the above text.

Section 4.1.2:

[TR] Added

[TR] oauth-pop-key-distribution is specific to OAuth 2.0 token and keying material distribution from authorization server to the client.
Added references to json drafts where these parameters are defined

NEW:

   k - Long-term key (K)
   exp - identifies the time after which the key expires.

   example:
   {
      "k" :
   "ESIzRFVmd4iZABEiM0RVZgKn6WjLaTC1FXAghRMVTzkBGNaaN496523WIISKerLi",
      "exp" : 1300819380,
      "kid" :"22BIjxU93h/IgwEb"
      "enc" : A256CBC-HS512
     }

   The parameter "k" is defined in
   Section 6.4.1 of [I-D.ietf-jose-json-web-algorithms], "enc" is
   defined in Section 4.1.2 of [I-D.ietf-jose-json-web-encryption],
   "kid" is defined in Section 4.1.4 of
   [I-D.ietf-jose-json-web-signature] and "exp" is defined in
   Section 4.1.4 of [I-D.ietf-oauth-json-web-token].  A256CBC-HS512 and
   other authenticated encryption algorithms are defined in
   [I-D.ietf-jose-json-web-algorithms].  In this case AS-RS key length
   must be 256-bit, AUTH key length must be 256-bit (section 2.6 of
   [RFC4868]).

-Tiru
-------------

Regards,

Christer

---

From: Christer Holmberg <[email-masked]>
Date: Fri, 13 Feb 2015 22:44:35 +0000

Hi,

Major Issues: None

Minor Issues: None

-------------

Section 1:

[Christer] True. My mistake. Comment withdrawn :)

-------------

Section 4:

[TR] Yes.

Something like:

Section 4.1.2:

[TR] Added

NEW:

   k - Long-term key (K)

   example:
   {
      "k" :

[Christer] Looks good.

Thanks!

Regards,

Christer

---

From: Jari Arkko <[email-masked]>
Date: Thu, 19 Feb 2015 13:41:37 +0200

Many thanks for the review, Christer. And thanks of the changes, Tiru.

Jari

On 14 Feb 2015, at 00:44, Christer Holmberg <[email-masked]> wrote:

>         “The procedure for establishment of the symmetric key is outside the scope of this
>         Sections 4.1.2, 4.1.2 and 4.1.3 show examples of mechanisms that can be used.”
>  
>  
> _______________________________________________
> Gen-art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/gen-art