Francesca, Thank you very much for addressing the comments. Linda -----Original Message----- From: Francesca Palombini <francesca.palombini@xxxxxxxxxxxx> Sent: Monday, August 24, 2020 12:07 PM To: Benjamin Kaduk <kaduk@xxxxxxx>; Linda Dunbar <linda.dunbar@xxxxxxxxxxxxx> Cc: ops-dir@xxxxxxxx; draft-ietf-ace-oscore-profile.all@xxxxxxxx; ace@xxxxxxxx; last-call@xxxxxxxx Subject: Re: Opsdir last call review of draft-ietf-ace-oscore-profile-11 Hi Linda, Thank you for your review. Ben has already clarified our aim for most of your points, thanks Ben. I just want to add that we have now added some text to clarify the CBOR formatting of Figure 7, you can see the diff here: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Face-wg%2Face-oscore-profile%2Fcommit%2F55d500a8922b5694dd821d4b1109cc162313fc2f&data=02%7C01%7Clinda.dunbar%40futurewei.com%7Cfb9220ea76fb4104e55408d84850226c%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637338856304552707&sdata=8c%2B%2FnJsZ9dS8KO9X%2FcaIm0LxN80fKXgPZSzXkfr1aac%3D&reserved=0 This will be included in the next update of the document. Thanks, Francesca On 27/07/2020, 20:08, "Benjamin Kaduk" <kaduk@xxxxxxx> wrote: Hi Linda, On Sun, Jul 19, 2020 at 08:16:17PM -0700, Linda Dunbar via Datatracker wrote: > Reviewer: Linda Dunbar > Review result: Has Nits > > I have reviewed this document as part of the Ops area directorate's ongoing > effort to review all IETF documents being processed by the IESG. These > comments were written primarily for the benefit of the Ops area directors. > Document editors and WG chairs should treat these comments just like any other > last call comments. > > This document describes how to set specific parameters in using the > Authentication and Authorization for Constrained Environments (ACE) framework > [I-D.ietf-ace-oauth-authz]. The document is written clear, except some minor > issues: > > Section 4.1.1 states that Nonce Parameter must be sent from the client to RS. > What would be the problem if the client doesn't include the "NONCE"? There's a little more discussion of the N1 in the previous section, but in essence, this nonce is required to protect the client against replayed responses. Since the token contents (including key derivation material) would be unchanged across security contexts, the nonce is used to make each one different; it has to be client-generated so that the client is sure that this security context is "fresh" (vs. replayed). > Page 12: It asks RFC editor to validate the numbers listed in Figure 7. There > is no explanation or comments for those values. It will be very difficult for > RFC editor to validate. It seems to me there are 4 columns but I can't > understand the meaning of the values under 1st, 2nd, and 3rd columns. I think this is just a note that the RFC Editor should make sure that someone has checked the values (i.e., the authors). The RFC Editor does not need to be the one actually doing the checking. Thanks for the review, Ben > it is kind of difficult to validate the correctness by just reading through the > document. It would be better to have an implementation report of the proposed > "Profile". > > Best Regards, > Linda Dunbar > > > -- last-call mailing list last-call@xxxxxxxx https://www.ietf.org/mailman/listinfo/last-call
