Subject: [Id-event] Push delivery - shepherd review

From: Yaron Sheffer <[email-masked]>
Date: Fri, 12 Apr 2019 15:44:42 +0300

There's always one more nit...

1.1: this documents -> this document

2: i.e., return an "access_denied" error response -> i.e.,
return an error response such as "access_denied" [because
rejection can result in other responses]

2.3: detects an error parsing or validating a SET transmitted
in a SET Transmission Request -> detects an error parsing,
validating or authenticating a SET transmitted in a SET
Transmission Request [because all later examples use status code
400 for this rather than 401, and this is an important enough
case to be stated  normatively].

5.2: PII: expand the acronym.

5.4: "then the SET Transmitter SHOULD sign the SET in
accordance with [RFC7515] and/or encrypt it using authenticated
encryption in accordance with [RFC7516]." The second half of
this sentence is incorrect. JWE with RSA (encrypted to the
Recipient) and AES-GCM does NOT authenticate the Transmitter. It
ensures message integrity but not authenticity.

7.1.1: error_code: please review again the ASCII ranges, or
better yet, spell out the allowed characters. For example, 0x20
is "space" which we probably don't want.

Thanks,

Yaron

---

From: Marius Scurtescu <[email-masked]>
Date: Sun, 14 Apr 2019 11:51:58 -0700

I captured all feedback here:
https://github.com/independentid/Identity-Events/pull/25

Please review and let me know if further edits are needed.

Thanks,
Marius

On Fri, Apr 12, 2019 at 5:45 AM Yaron Sheffer <[email-masked]> wrote:

>    - 1.1: this documents -> this document
>    - 2: i.e., return an "access_denied" error response -> i.e., return an
>    error response such as "access_denied" [because rejection can result in
>    other responses]
>    - 2.3: detects an error parsing or validating a SET transmitted in a
>    SET Transmission Request -> detects an error parsing, validating or
>    authenticating a SET transmitted in a SET Transmission Request [because all
>    later examples use status code 400 for this rather than 401, and this is an
>    important enough case to be stated  normatively].
>    - 5.2: PII: expand the acronym.
>    - 5.4: "then the SET Transmitter SHOULD sign the SET in accordance
>    with [RFC7515] and/or encrypt it using authenticated encryption in
>    accordance with [RFC7516]." The second half of this sentence is incorrect.
>    JWE with RSA (encrypted to the Recipient) and AES-GCM does NOT authenticate
>    the Transmitter. It ensures message integrity but not authenticity.
>    - 7.1.1: error_code: please review again the ASCII ranges, or better
>    yet, spell out the allowed characters. For example, 0x20 is "space" which
>    we probably don't want.
>
> Thanks,
>
>     Yaron
> _______________________________________________
> Id-event mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/id-event
>