Subject: [Id-event] Push-Based SET Delivery over HTTP draft updated to 06

From: "Richard Backman, Annabelle" <[email-masked]>
Date: Thu, 9 May 2019 22:16:06 +0000

We just published an update to Push-Based SET Delivery over HTTP, containing fixes for issues identified in the shepherd review:

  *   1.1: this documents -> this document
  *   2: i.e., return an "access_denied" error response -> i.e., return an error response such as "access_denied" [because rejection can result in other responses]
  *   2.3: detects an error parsing or validating a SET transmitted in a SET Transmission Request -> detects an error parsing, validating or authenticating a SET transmitted in a SET Transmission Request [because all later examples use status code 400 for this rather than 401, and this is an important enough case to be stated  normatively].
  *   5.2: PII: expand the acronym.
  *   5.4: "then the SET Transmitter SHOULD sign the SET in accordance with [RFC7515] and/or encrypt it using authenticated encryption in accordance with [RFC7516]." The second half of this sentence is incorrect. JWE with RSA (encrypted to the Recipient) and AES-GCM does NOT authenticate the Transmitter. It ensures message integrity but not authenticity.
  *   7.1.1: error_code: please review again the ASCII ranges, or better yet, spell out the allowed characters. For example, 0x20 is "space" which we probably don't want.
The latest version can be found at the IETF DataTracker page for the document:
https://datatracker.ietf.org/doc/draft-ietf-secevent-http-push/

--
Annabelle Richard Backman
AWS Identity