Subject: [Id-event] I-D Action: draft-ietf-secevent-http-push-05.txt

From: [email-masked]
Date: Mon, 11 Mar 2019 11:41:33 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Security Events WG of the IETF.

        Title           : Push-Based Security Event Token (SET) Delivery Using HTTP
        Authors         : Annabelle Backman
                          Michael B. Jones
                          Marius Scurtescu
                          Morteza Ansari
                          Anthony Nadalin
	Filename        : draft-ietf-secevent-http-push-05.txt
	Pages           : 20
	Date            : 2019-03-11

Abstract:
   This specification defines how a Security Event Token (SET) may be
   delivered to an intended recipient using HTTP POST.  The SET is
   transmitted in the body of an HTTP POST request to an endpoint
   operated by the recipient, and the recipient indicates successful or
   failed transmission via the HTTP response.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-secevent-http-push/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-secevent-http-push-05
https://datatracker.ietf.org/doc/html/draft-ietf-secevent-http-push-05

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-secevent-http-push-05

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Richard Backman, Annabelle" <[email-masked]>
Date: Mon, 11 Mar 2019 20:02:43 +0000

Hello all,

This update contains the corrections and suggestions provided during WGLC, plus those Mike shared with the list this past weekend.

Here is the change log from -02 to -03:

   o  Made minor editorial corrections.

   o  Updated example request with a correct SET header and signature.

   o  Revised TLS guidance to allow implementers to provide
      confidentiality protection via JWE.

   o  Revised TLS guidance to require *at least* TLS 1.2.

   o  Revised TLS guidance to recommend supporting the newest version of
      TLS that meets security requirements.

   o  Revised SET Delivery Error Code format to allow the same set of
      characters as is allowed in error codes in RFC6749.

   o  Added mention of HTTP Poll spec to list of other streaming specs
      in appendix.

   o  Added validation step requiring SET Recipient to verify that the
      SET is one which the SET Transmitter is expected to send to the
      SET Recipient.

   o  Changed responding to errors with an appropriate HTTP status code
      from optional to recommended.

   o  Changed Error Codes registry change policy from Expert Review to
      First Come First Served; added guidance that error codes are meant
      to be consumed by automated systems.

   o  Added text making clear that it is up to SET Recipients whether or
      not they will accept SETs where the SET Issuer is different from
      the SET Transmitter.

   o  Reworded guidance around signing and/or encrypting SETs for
      integrity protection.

   o  Renamed TLS "Support Considerations" section to "Confidentiality
      of SETs".

   o  Reworded guidance around subject identifier selection and privacy
      concerns.

-- 
Annabelle Richard Backman
AWS Identity

On 3/11/19, 11:42 AM, "Id-event on behalf of [email-masked]" <[email-masked] on behalf of [email-masked]> wrote:

    
    Abstract:

    

    
    _______________________________________________
    Id-event mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/id-event