Subject: [appsdir] Scans for draft-ietf-tokbind-protocol and draft-ietf-tokbind-https

From: Ted Hardie <[email-masked]>
Date: Tue, 7 Apr 2015 17:15:08 -0700

draft-ietf-tokbind-protocol will need significant attention, especially
from folks with application security, privacy,  and web services
backgrounds.  Though the draft isn't very long, it describes a general
method of binding application security tokens to a channel and reusing them
with a server as well as methods for taking those issued by one server and
using them elsewhere.  The interaction between the binding and application
semantics will likely be a focus of reviews, as would be the privacy
implication of a long-lived token of this type (though the draft presumes
the ability to clear state, it's not at all clear that this would be
available to mobile apps or similar).

draft-ietf-tokbind-https will need a similar amount of attention,
especially from folks familiar with HTTP semantics (headers and status code
semantics being two areas of concern).  In essence, this is the worked
example of the protocol, embodied in HTTP.

regards,

Ted

---

From: Martin Thomson <[email-masked]>
Date: Wed, 8 Apr 2015 09:38:31 -0700

FYI, I've been paying attention to these.  They certainly need a lot
of attention.  I have suggested several changes that - if they are
accepted - will completely change the structure of the two drafts.
One of those proposed changes is a merge of the drafts.  The authors
have accepted the need to change the negotiation portion in -protocol
entirely.

Attention is definitely warranted, but some delay might avoid some churn.

On 7 April 2015 at 17:15, Ted Hardie <[email-masked]> wrote:
> draft-ietf-tokbind-protocol will need significant attention, especially from
> folks with application security, privacy,  and web services backgrounds.
> Though the draft isn't very long, it describes a general method of binding
> application security tokens to a channel and reusing them with a server as
> well as methods for taking those issued by one server and using them
> elsewhere.  The interaction between the binding and application semantics
> will likely be a focus of reviews, as would be the privacy implication of a
> long-lived token of this type (though the draft presumes the ability to
> clear state, it's not at all clear that this would be available to mobile
> apps or similar).
>
> draft-ietf-tokbind-https will need a similar amount of attention, especially
> from folks familiar with HTTP semantics (headers and status code semantics
> being two areas of concern).  In essence, this is the worked example of the
> protocol, embodied in HTTP.
>
> regards,
>
> Ted
>
> _______________________________________________
> appsdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/appsdir
>

---

From: Eliot Lear <[email-masked]>
Date: Wed, 08 Apr 2015 19:38:01 +0200

Thank you both.  I will work with the reviewer on timing based on your
advice, Martin.

Eliot