Subject: [websec] new rev: draft-ietf-websec-strict-transport-sec-08

From: =JeffH <[email-masked]>
Date: Thu, 17 May 2012 13:33:18 -0700

New rev:
https://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-08

full issue ticket list for strict-transport-sec:
<http://trac.tools.ietf.org/wg/websec/trac/query?status=assigned&status=closed&status=new&status=reopened&component=strict-transport-sec&order=id>

Redline spec diff from previous rev:
https://tools.ietf.org/rfcdiff?difftype=--hwdiff&url2=draft-ietf-websec-strict-transport-sec-08.txt

side-by-side diff from previous rev:
https://tools.ietf.org/rfcdiff?url2=draft-ietf-websec-strict-transport-sec-08.txt

Change Log is below.

=JeffH

==============================================================

Appendix D. Change Log

    [RFCEditor: please remove this section upon publication as an RFC.]

    Changes are grouped by spec revision listed in reverse issuance
    order.

D.1.  For draft-ietf-websec-strict-transport-sec

       Changes from -07 to -08:

       1.  Clarified requirement #4 for STS header field directives in
           Section 6.1, and removed "(which "update" this
           specification)".  Also added explicit "max-age=0" to Section
           6.1.1.  Reworked final sentence in 2nd para of Section 13.
           This addresses issue ticket #45.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/45>

       Changes from -06 to -07:

       1.  Various minor/modest editorial tweaks throughout as I went
           through it pursuing the below issue tickets.  Viewing a visual
           diff against -06 revision recommended.

       2.  fixed some minor editorial issues noted in review by Alexey,
           fixes noted in here: <https://www.ietf.org/mail-archive/web/
           websec/current/msg01163.html>

       3.  Addressed ABNF exposition issues, specifically inclusion of
           quoted-string syntax for directive values.  Fix STS header
           ABNF such that a leading ";" isn't required.  Add example of
           quoted-string-encoded max-age-value.  This addresses (re-
           opened) issue ticket #33.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/33>

       4.  Reworked sections 8.1 through 8.3 to ensure matching algorithm
           and resultant HSTS Policy application is more clear, and that
           it is explicitly stipulated to not muck with attributes of
           superdomain matching Known HSTS Hosts.  This addresses issue
           ticket #37.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/37>

       5.  Added reference to [I-D.ietf-dane-protocol], pared back
           extraneous discussion in section 2.2, and updated discussion
           in 10.2 to accomodate TLSA (nee DANE).  This addresses issue
           ticket #39.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/39>

       6.  Addressed various editorial items from issue ticket #40.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/40>

       7.  Loosened up the language regarding redirecting "http" requests
           to "https" in section 7.2 such that future flavors of
           permanent redirects are accommodated.  This addresses issue
           ticket #43.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/43>

       8.  Reworked the terminology and language in Section 9, in
           particular defining the term "putative domain name string" to
           replace "valid Unicode-encoded string-serialized domain name".
           This addresses issue ticket #44.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/44>

        Changes from -05 to -06:
                 .
                 .
                 .
                 .
---
end

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 31 May 2012 15:17:45 +0100

Most of my issues were addressed in the latest version, except for this one:

 > 6.1.  Strict-Transport-Security HTTP Response Header Field
 >
 > 4.  UAs MUST ignore any STS header fields containing directives, or
 >      other header field value data, that does not conform to the
 >      syntax defined in this specification.

So this is saying that syntactically invalid STS header fields are
to be ignored. This still doesn't say if unrecognized directives are to
be ignored or not. (Because they can comply with the generic syntax for
directives, so they would be syntactically valid, albeit unrecognized).
So can you please add an explicit sentence about that?

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 31 May 2012 16:20:14 -0700

I didn't send a message between -06 and -07, but -07 (and thus -08) fixed all the issues I care about. It's looking great.

--Paul Hoffman