Subject: [saag] Input for conflict review of draft-secure-cookie-session-protocol

From: Barry Leiba <[email-masked]>
Date: Wed, 17 Oct 2012 22:13:15 -0400

A document titled "Secure Cookie Sessions for HTTP" has been submitted
to the Independent Stream Editor (ISE):
http://datatracker.ietf.org/doc/draft-secure-cookie-session-protocol/

The IESG has been asked to review the document, as specified in RFC
5742, Section 3.  The Security and Applications Area Directors are
looking for input for that review.  Please post any relevant comments
to this list, <[email-masked]>, as soon as possible, and at least by 1
November 2012.

Please read RFC 5742, Section 3, and be aware that we are not looking
for detailed comments on the document itself (see below).  We
specifically need input on whether this document is in conflict with
work that's being done in the IETF.  Look at the five possible
responses specified in that section, and help us determine whether any
of 2 through 5 applies.  Please be specific in your response.

In addition to this, we're sure that the authors and the ISE would
appreciate comments about the document.  If you have those, you may
send them directly to the authors at
<[email-masked]>
and to the ISE at <[email-masked]>.
General discussion of the document on this list will likely not get to the
authors or the ISE.

Barry Leiba, Applications AD

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 21 Oct 2012 12:24:11 +0100

So looking at the mails on this, it strikes me that maybe
if the document had a slightly different title that might
resolve all the 5742 concerns about whether or not it
conflicts with IETF work.

If it were called "KoanLogic's Secure cookie Sessions
for HTTP" would that then be ok? IMO, it ought. That way,
the independent-stream RFC won't confuse anyone into
thinking that the IETF as a whole has developed this, but
if some IETF WG wants to do similar work, this could be
useful input. (And adding one word seems likely quicker
than organising and coming to IETF rough consensus;-)

What do folks (incl. authors) think of that?

I realise that the above suggested name isn't quite on
the button, since no doubt a lot of sites manage cookies
in almost the same way. But maybe its good-enough.

Cheers,
S.

On 10/18/2012 03:13 AM, Barry Leiba wrote:
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag
> 
>

---

From: Thomas Fossati <[email-masked]>
Date: Sun, 21 Oct 2012 20:49:04 +0100

Hi Stephen,

> What do folks (incl. authors) think of that?

I think you've hit the point, and (as author) I share the proposed way-out.
I only have a bit of concern about sticking the name of a company in
the title, which seems quite an unusual practice... Would
"HTTP-friendly authentication tokens" be a less controversial
synthesis for what SCS actually is ?

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 21 Oct 2012 21:59:52 +0100

Hi Thomas,

On 10/21/2012 08:49 PM, Thomas Fossati wrote:
> the title, which seems quite an unusual practice... 

Actually, its relatively common for independent-stream RFCs that
specify protocols to be called "<company>'s <foo> protocol"

S.

> Would