Subject: [Id-event] Benjamin Kaduk's Yes on draft-ietf-secevent-http-push-12: (with COMMENT)

From: Benjamin Kaduk via Datatracker <[email-masked]>
Date: Tue, 16 Jun 2020 17:56:02 -0700

Benjamin Kaduk has entered the following ballot position for
draft-ietf-secevent-http-push-12: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-secevent-http-push/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

We mention DNS-ID in the context of RFC 6125 validation in Section 5.3, but
not in Section 3.  We don't necessarily need to mention it in both places, but
it might be nice to be consistent or to remove some of the redundancy.

Section 6

I think both SET Issuers and Transmitters (not just one or the other) should
consider the ramifications of sharing a particular SET.  While it's true that
(as the secdir reviewer noted) when JWE is used the Issuer has sole
knowledge/control, but in other cases the Issuer may not know the full
recipient list.

Appendix A

(Some information leakage is possible even over the TLS channel, too.  Message
padding algorithms to prevent such side channels remain an open research
topic.)

To the IESG: note that Appenix B ("Other Streaming Specifications") is
currently slated for removal prior to publication.

---

From: Mike Jones <[email-masked]>
Date: Thu, 25 Jun 2020 03:56:25 +0000

Thanks for your review, Ben.  https://tools.ietf.org/html/draft-ietf-secevent-http-push-13 is intended to address your comments.  Detailed replies are inline, prefixed by "Mike>".

-----Original Message-----
From: Benjamin Kaduk via Datatracker <[email-masked]> 
Sent: Tuesday, June 16, 2020 5:56 PM
To: The IESG <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]; Yaron Sheffer <[email-masked]>; [email-masked]
Subject: Benjamin Kaduk's Yes on draft-ietf-secevent-http-push-12: (with COMMENT)

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)

We mention DNS-ID in the context of RFC 6125 validation in Section 5.3, but not in Section 3.  We don't necessarily need to mention it in both places, but it might be nice to be consistent or to remove some of the redundancy.

Mike> DNS-ID is now uniformly included in both drafts.

Section 6

I think both SET Issuers and Transmitters (not just one or the other) should consider the ramifications of sharing a particular SET.  While it's true that (as the secdir reviewer noted) when JWE is used the Issuer has sole knowledge/control, but in other cases the Issuer may not know the full recipient list.

Mike> Both are now called out.

Appendix A

(Some information leakage is possible even over the TLS channel, too.  Message padding algorithms to prevent such side channels remain an open research
topic.)

Mike> I described this in a note in the appendix.

To the IESG: note that Appenix B ("Other Streaming Specifications") is currently slated for removal prior to publication.

				Thanks again,
				-- Mike