On Aug 4, 2026, at 8:29 AM, Filip Skokan <[email protected]> wrote:
Dear RFC Editor(s),
Thank you for the careful review. Our consolidated responses
follow. Textual changes use the requested OLD/NEW format.
1) The new BCP assignment is correct.
2) Global (document title)
OLD:
Cross-Device Flows: Security Best Current Practice
NEW:
Best Current Practice for Security of Cross-Device Flows
3) Section 1.2
OLD:
This flow may be streamlined by rendering the session transfer
code as a QR code on the Authorization Device and scanned by the
Consumption Device.
NEW:
This flow may be streamlined by rendering the session transfer
code as a QR code on the Authorization Device and scanning it with
the Consumption Device.
4) Section 1.2
OLD:
These flows are often used to add new devices to a network,
onboard customers to a mobile application, or provision new
credentials (e.g., [OpenID.SIOPV2]).
NEW:
These flows are often used to add new devices to a network,
onboard customers to a mobile application, or provision new
credentials (e.g., as described in [OpenID.SIOPV2]).
5) Section 1.4
OLD:
This specification uses the terms "access token", "refresh token",
"authorization server", "resource server", "authorization
endpoint", "authorization request", and "client" defined in "The
OAuth 2.0 Authorization Framework" [RFC6749].
NEW:
This specification uses the terms "access token", "refresh token",
"authorization server", "resource server", "authorization
request", and "client" defined in "The OAuth 2.0 Authorization
Framework" [RFC6749].
6) Section 2
OLD:
Section 3 provides details about susceptible protocols, and
Section 4 provides attack descriptions. Section 6.1 provides
details about the security mechanisms and mitigations, Section 6.2
provides protocol selection guidance, and Section 6.3 provides
details from formal analysis of protocols that apply to
cross-device flows.
NEW:
Section 3 provides details about susceptible protocols, and
Section 4 provides attack descriptions. Section 5 provides an
overview of existing protocols and standards. Section 6.1 provides
details about the security mechanisms and mitigations, Section 6.2
provides protocol selection guidance, and Section 6.3 provides
details from formal analysis of protocols that apply to
cross-device flows.
7) Section 3.3.8 (heading)
OLD:
Example A8: Access a Productivity Application
NEW:
Example A8: Access a Productivity Application (User-Transferred
Authorization Data Pattern)
Section 4.3.8
OLD:
Example B8: Account Takeover (User-Transferred Session Data Pattern)
This exploit applies to the use case described in Section 3.3.8.
An attacker wants to use some website that requires presentation
of a verifiable credential for authentication. The attacker
creates a phishing website, which will in real time capture login
QR codes from the original website and present these to the user.
The attacker tries to get the user to use the phishing website by
sending messages by email or other messaging technologies. The
user scans the QR code on the phishing website, invokes their
digital wallet, and presents their credentials. Once the
credentials are presented, the original session from the
attacker's device is authorized with the user's credentials.
NEW:
Example B8: Account Takeover (User-Transferred Authorization Data
Pattern)
This exploit applies to the use case described in Section 3.3.8.
An attacker obtains a user's credentials for a Computer-Aided
Design (CAD) application but cannot complete the authorization
without the 6-digit authorization code sent to the user's mobile
phone. The attacker triggers the authorization request, causing
the Authorization Server to send a 6-digit authorization code to
the user's mobile phone. The attacker then contacts the user,
claiming to be from the CAD application's support desk and
investigating a problem with the user's account, and asks the user
to read back the code they have just received. Because the
attacker has established the context for the code, the user
provides it. The attacker enters the code in the CAD application
and obtains access to the user's designs.
8) This change is superseded by the replacement text for Section
4.3.8 in response 7.
9) Section 5
OLD:
An authorization server MAY use techniques such as device
fingerprinting, network address, or other techniques to detect if
a cross-device protocol is being used on the same device.
NEW:
An Authorization Server MAY use device fingerprinting, network
address, or other techniques to detect if a cross-device protocol
is being used on the same device.
10) Section 6.1.1
OLD:
The paragraph beginning "Note: There are scenarios that require
that authorization takes place..." is a normal paragraph.
NEW:
Place this paragraph in an <aside> element.
11) Section 6.1.5
OLD:
Some scenarios may require legitimate retransmission of user, QR,
and authorization data (e.g., retries).
NEW:
Some scenarios may require legitimate retransmission of user data,
QR codes, and authorization data (e.g., retries).
12) Section 6.1.8
OLD:
In some deployments, a trusted network may also be inferred using
SIM or network operator supplied information.
NEW:
In some deployments, a trusted network may also be inferred using
information supplied by a Subscriber Identity Module (SIM) or the
network operator.
13) Section 6.1.8
OLD:
Even if it is possible to deploy network-level controls, it SHOULD
be used in conjunction with other controls outlined in this
document to achieve defense in depth.
NEW:
Even if it is possible to deploy network-level controls, they
SHOULD be used in conjunction with other controls outlined in this
document to achieve defense in depth.
Section 6.1.11
OLD:
Therefore, it should be used along with other techniques to
provide a defense-in-depth defense against cross-device attacks.
NEW:
Therefore, they should be used along with other techniques to
provide defense in depth against cross-device attacks.
14) Section 6.2.1.4
OLD:
In addition to the security considerations section in the
standard, it is RECOMMENDED that one or more of the mitigations
outlined in this document be considered, especially mitigations
that can help establish proximity or prevent attackers from
obtaining QR or user codes.
NEW:
In addition to the Security Considerations section in [RFC8628],
it is RECOMMENDED that one or more of the mitigations outlined in
this document be considered, especially mitigations that can help
establish proximity or prevent attackers from obtaining QR or user
codes.
Section 6.2.2.4
OLD:
In addition to the security considerations section in the
standard, it is RECOMMENDED that one or more of the mitigations
outlined in this document be considered, especially mitigations
that can help establish proximity or prevent attackers from
initiating authorization requests.
NEW:
In addition to the Security Considerations section in [CIBA], it
is RECOMMENDED that one or more of the mitigations outlined in
this document be considered, especially mitigations that can help
establish proximity or prevent attackers from initiating
authorization requests.
15) Section 6.2.2.2
OLD:
Less susceptible to unauthenticated channel attacks, but still
vulnerable to attackers who know or can guess the user identifier
and initiate an attack as described in Section 4.3.4.1.
NEW:
CIBA is less susceptible to unauthenticated channel attacks, but
it is still vulnerable to attackers who know or can guess the user
identifier and initiate an attack as described in Section 4.3.4.1.
16) Section 6.2.3.2
OLD:
The CDA flow proves proximity by leveraging BLE advertisements for
service establishment, significantly reducing the susceptibility
to any of the exploits described in examples 1-6.
NEW:
The CDA flow proves proximity by leveraging BLE advertisements for
service establishment, significantly reducing the susceptibility
to any of the exploits described in examples B1-B6 in Section 4.3.
17) References
a) Please alphabetize the references.
b) The updates to [W3CWebAuthn], [OpenID.VP], [OpenID.Core], and
[W3C.DCAPI] look correct.
c) The update to [NEWDCPHISH] looks correct.
d) The update to [DCATTACK] looks correct.
18) Global terminology
OLD:
Mixed use of "Authorization Server" and "authorization server".
NEW:
Use "Authorization Server" consistently.
OLD:
Mixed use of "sender-constrained tokens" and "sender-constraining
tokens".
NEW:
Use "sender-constrained tokens" consistently.
OLD:
Mixed forms of "defense in depth".
NEW:
Use "defense in depth" as a noun phrase and "defense-in-depth"
when used attributively. No definition in Section 1.4 is needed.
OLD:
Pattern names use inconsistent capitalization.
NEW:
Capitalize pattern names consistently, including:
User-Transferred Session Data Pattern
Backchannel-Transferred Session Pattern
User-Transferred Authorization Data Pattern
Cross-Device Session Transfer Pattern
OLD:
Device Authorization Grant
Authorization Code Grant
Authorization Code Flow
NEW:
device authorization grant
authorization code grant
authorization code flow
No changes are required to the different forms of "user code" and
"QR code" listed in question 18(d).
19) Abbreviations
a) "Proof Key for Code Exchange (PKCE)" is correct.
b) Section 6.1.7
OLD:
Trusted devices MAY have their identities rooted in hardware
(e.g., a TPM or equivalent technology).
NEW:
Trusted devices MAY have their identities rooted in hardware
(e.g., a Trusted Platform Module (TPM) or equivalent technology).
SIM is expanded in the response to question 12.
FAPI has no current official expansion. Please refer to it as
"OpenID FAPI". If a link is useful, the working group page is
https://openid.net/wg/fapi/.
SATMC is the name of the tool and should remain unexpanded.
c) Global
OLD:
Client-Initiated Backchannel Authentication is expanded repeatedly.
NEW:
Expand the first occurrence as "Client-Initiated Backchannel
Authentication (CIBA)" and use "CIBA" thereafter.
20) Global
The terms "native client" and "native apps" should remain unchanged.
OLD:
traditional phishing attacks
NEW:
conventional phishing attacks
Thank you,
Pieter, Daniel, and Filip
On Fri, 31 Jul 2026 at 06:42, <[email protected]> wrote:
Authors,
While reviewing this document during Final Review, please resolve
(as necessary) the following questions, which are also in the
source file.
1) <!--[rfced] This document has been assigned a new BCP number.
Please let us
know if this is not correct (i.e., it should be part of an
existing BCP).
See the complete list of BCPs here:
https://www.rfc-editor.org/bcps
-->
2) <!-- [rfced] May we update the document title as follows to
align with other RFC
titles that include "Best Current Practice"?
Original:
Cross-Device Flows: Security Best Current Practice
Perhaps:
Best Current Practice for Security of Cross-Device Flows
-->
3) <!-- [rfced] In the text below, how may we clarify "and scanned
by"?
Original:
This flow may be streamlined by rendering the
session transfer code as a QR code on the Authorization Device
and
scanned by the Consumption Device.
Perhaps A:
This flow may be streamlined by rendering the
session transfer code as a QR code on the Authorization Device
and
scanning it with the Consumption Device.
Perhaps B:
This flow may be streamlined by rendering the
session transfer code as a QR code on the Authorization Device
that is
scanned by the Consumption Device.
-->
4) <!-- [rfced] How may we clarify "(e.g., [OpenID.SIOPV2])" here?
Is the intent
"(e.g., as described in [OpenID.SIOPV2])"?
Original:
These flows are
often used to add new devices to a network, onboard customers
to a
mobile application, or provision new credentials (e.g.,
[OpenID.SIOPV2]).
Perhaps:
These flows are
often used to add new devices to a network, onboard customers
to a
mobile application, or provision new credentials (e.g., as
described in
[OpenID.SIOPV2]).
-->
5) <!-- [rfced] The term "authorization endpoint" is listed in
Section 1.4 but is
not used elsewhere in the document. Should it be removed from
Section 1.4?
-->
6) <!-- [rfced] Should Section 5 be mentioned in this paragraph?
If so, please
provide the text.
Current:
Section 3 provides details about susceptible protocols, and
Section 4
provides attack descriptions. Section 6.1 provides details
about the
security mechanisms and mitigations, Section 6.2 provides
protocol
selection guidance, and Section 6.3 provides details from formal
analysis of protocols that apply to cross-device flows.
-->
7) <!-- [rfced] We note empty parentheses in the section title
below. We have
removed them, but please review and let us know if you would like
to add any
text to them. We see that other subsections of Section 3.3 have
parentheses that
indicate the applicable pattern.
Original:
3.3.8. Example A8: Access a Productivity Application ()
-->
8) <!-- [rfced] May we move "in real time" as shown below to
improve the flow of
this sentence?
Original:
The attacker creates a
phishing website which will in real time capture log-in QR
Codes from
the original website and present these to the user.
Perhaps:
The attacker creates a
phishing website, which will capture login QR codes from
the original website and present them to the user in real time.
-->
9) <!-- [rfced] May we update this sentence to avoid using
"techniques" twice?
Original:
An authorization server MAY use techniques such as device
fingerprinting, network address or other techniques to detect
if a
cross-device protocol is being used on the same device.
Perhaps:
An authorization server MAY use device
fingerprinting, network address, or other techniques to detect
if a
cross-device protocol is being used on the same device.
-->
10) <!-- [rfced] Please review whether the note in Section 6.1.1
(i.e., the text
prefaced with "Note:") should be in the <aside> element. It is
defined as "a
container for content that is semantically less important or
tangential to the
content that surrounds it"
(https://authors.ietf.org/en/rfcxml-vocabulary#aside).
-->
11) <!-- [rfced] Should "of user, QR and authorization data" be
updated as follows?
Original:
Some scenarios may require legitimate re-transmission
of user, QR and authorization data (e.g., retries).
Perhaps:
Some scenarios may require legitimate retransmission
of user codes, QR codes, and authorization data (e.g., retries).
-->
12) <!-- [rfced] Is the information supplied by the network
operator (Perhaps
A) or by SIM or the network operator (Perhaps B)?
Original:
In some deployments a trusted network may also
be inferred using SIM or network operator supplied information.
Perhaps A:
In some deployments, a trusted network may also
be inferred using SIM or information supplied by the network
operator.
Perhaps B:
In some deployments, a trusted network may also
be inferred using information supplied by SIM or the network
operator.
-->
13) <!-- [rfced] We have a question about "it SHOULD", which
appears in the second
sentence of each block of text below (first sentence is included
for context).
Should "it SHOULD" be updated to "they SHOULD", "this mitigation
SHOULD", or
something similar? We believe that the pronoun "it" refers to
"network-level
controls" in the first text block and to "rate limits" in the
second text block.
Original:
*Limitations:* Network level controls may not always be feasible,
especially when dealing with consumer scenarios where the
network may
not be under control of the service provider. Even if it is
possible
to deploy network level controls, it SHOULD be used in
conjunction
with other controls outlined in this document to achieve
defence in-
depth.
...
*Limitations:* Rate limits are effective at slowing an
attacker down
and help to degrade scaled attacks, but they do not prevent more
targeted attacks that are executed with lower volumes and
velocity.
Therefore, it should be used along with other techniques to
provide a
defense-in-depth defense against cross-device attacks.
Perhaps:
*Limitations:* Network-level controls may not always be feasible,
especially when dealing with consumer scenarios where the
network may
not be under control of the service provider. Even if it is
possible
to deploy network-level controls, they SHOULD be used in
conjunction
with other controls outlined in this document to achieve
defense in
depth.
...
*Limitations:* Rate limits are effective at slowing an
attacker down
and help to degrade scaled attacks, but they do not prevent more
targeted attacks that are executed with lower volumes and
velocity.
Therefore, they should be used along with other techniques to
provide a
defense-in-depth defense against cross-device attacks.
-->
14) <!-- [rfced] In the sentences below, would it be helpful to
clarify "the
standard"?
Original:
In addition to the security considerations section in the
standard,
it is RECOMMENDED that one or more of the mitigations outlined in
this document be considered, especially mitigations that can help
establish proximity or prevent attackers from obtaining QR or
user
codes.
...
In addition to the security considerations section in the
standard,
it is RECOMMENDED that one or more of the mitigations outlined in
this document be considered, especially mitigations that can help
establish proximity or prevent attackers from initiating
authorization requests.
Perhaps:
In addition to the Security Considerations section in [RFC8628],
it is RECOMMENDED that one or more of the mitigations outlined in
this document be considered, especially mitigations that can help
establish proximity or prevent attackers from obtaining QR or
user
codes.
...
In addition to the Security Considerations section in [CIBA],
it is RECOMMENDED that one or more of the mitigations outlined in
this document be considered, especially mitigations that can help
establish proximity or prevent attackers from initiating
authorization requests.
-->
15) <!-- [rfced] What is the subject of the sentence below?
Specifically, what does
"less susceptible" refer to?
Original:
Less susceptible to unauthenticated channel attacks, but still
vulnerable to attackers who know or can guess the user
identifier and
initiate an attack as described in Section 4.3.4.1.
Perhaps:
CIBA is less susceptible to unauthenticated channel attacks,
but it is still
vulnerable to attackers who know or can guess the user
identifier and
initiate an attack as described in Section 4.3.4.1.
-->
16) <!-- [rfced] Would adding a section number to indicate where
readers can find
examples 1-6 be helpful here? Also, should "examples 1-6" be
updated to
"examples B1-B6"?
Original:
The Cross-Device Authentication flow proves proximity by
leveraging
BLE advertisements for service establishment, significantly
reducing
the susceptibility to any of the exploits described in
Examples 1-6.
Perhaps:
The Cross-Device Authentication flow proves proximity by
leveraging
BLE advertisements for service establishment, significantly
reducing
the susceptibility to any of the exploits described in
examples 1-6
in Section 4.3.
-->
17) <!-- [rfced] Please review the following questions regarding
the References
section of this document:
a) Would you like the references to be alphabetized or left in
their current order?
b) FYI - The reference entries below contained outdated
information based
on the URLs provided, so we have updated them to match the
information
found at the URLs. Please review the changes made to the following
reference entries:
[W3CWebAuthn]
[OpenID.VP]
[OpenID.Core]
[W3C.DCAPI]
c) FYI - The original URL for the reference [NEWDCPHISH] is no
longer valid
(https://o365blog.com/post/phishing/#new-phishing-technique-device-code-authentication).
It appears the author moved their blog to a new domain
(https://x.com/DrAzureAD/status/1579875043563438080). We have
updated this
reference to use the newer URL.
Original:
[NEWDCPHISH]
Syynimaa, N., "Introducing a new phishing technique
for
compromising Office 365 accounts", October 2020,
<https://o365blog.com/post/phishing/#new-phishing-
technique-device-code-authentication>.
Updated:
[NEWDCPHISH]
Syynimaa, N., "Introducing a new phishing technique
for
compromising Office 365 accounts", October 2020,
<https://aadinternals.com/post/phishing/>.
d) FYI - The original URL for the reference [DCATTACK] redirects
to an updated
page
(https://www.secureworks.com/blog/oauths-device-code-flow-abused-in-phishing-attacks).
It appears Secureworks was acquired by Sophos in February 2025
(https://www.sophos.com/en-us/secureworks-sophos-acquistion). We
have updated
this reference to match the information at the new URL. Please let
us know if
you have any objections.
Original:
[DCATTACK] Secureworks Counter Threat Unit (CTU), "OAuth's Device
Code Flow Abused in Phishing Attacks", August 2021,
<https://www.secureworks.com/blog/oauths-device-code-flow-
abused-in-phishing-attacks>.
Updated:
[DCATTACK] Secureworks Counter Threat Unit Research Team,
"OAuth's
Device Code Flow Abused in Phishing Attacks", June
2021,
<https://www.sophos.com/en-us/blog/oauths-device-code-
flow-abused-in-phishing-attacks>.
-->
18) <!-- [rfced] Terminology
a) We note inconsistencies in the terms below throughout the text.
Should these
be uniform? If so, please let us know which form is preferred.
Authorization Server
authorization server
sender-constrained tokens
sender-constraining tokens
defense in depth
defence in-depth
defence-in-depth defence
Note: We updated to use "defense" (with "s"). We see that the
NIST Glossary, which is an informative reference for this
document, uses "defense-in-depth" with hyphens (see
https://csrc.nist.gov/glossary/term/defense_in_depth). This term
has not been used often in the RFC Series. We see a few instances
of "defense in depth" (open) and "defense-in-depth" (hyphenated)
in published RFCs. The hyphenated forms are mostly used in the
attributive position (i.e., before a noun) such as
"defense-in-depth approach". Also will readers know what this term
means? Should it be added to Section 1.4 ("Conventions and
Terminology")?
b) In general text, should the names of patterns be capitalized or
lowercased? We
see both forms in the document.
Lowercase:
Examples of the user-transferred authorization data pattern
include
flows in which the Consumption Device requests the Authorization
Server ...
In the backchannel-transferred session pattern, the client
requests
the authorization server to authenticate the user and obtain
authorization for an action.
In cross-device flows that follow the user-transferred
authorization
data pattern, the client ...
Attackers exploit the user-transferred authorization data
pattern by
combining the social engineering techniques ...
Capitalized:
... using the Backchannel-Transferred Session pattern only after
the user is already authenticated and attempts a high-value
transaction.
In the User-Transferred Session Data Pattern, users MAY enter
out-of-
band information on the Consumption Device to start the
authorization
process.
... on the primary device (Backchannel-Transferred Session
Pattern, Section 3.1.2).
... to approve the authentication
attempt on the primary device (User-Transferred Session Data
Pattern, Section 3.1.1).
c) Would you like to make the following capitalization changes per
usage in RFCs
8628 and 6749? Or do you prefer the current capitalization?
"Device Authorization Grant" to "device authorization grant" (per
RFC 8628)
"Authorization Code Grant" to "authorization code grant" (per RFC
6749)
"Authorization Code Flow" to "authorization code flow" (per RFC 6749)
d) We see the following forms in the document; we did not make any
changes as
the meaning is clear, but let us know if you would like for the
usage to be
consistent. Note that plurals of these forms also appear in the
document.
user code or QR code
user or QR code
QR code or user code
QR or user code
-->
19) <!-- [rfced] Abbreviations
a) FYI - We have expanded the following abbreviation per Section
3.6 of RFC 7322
("RFC Style Guide"). Please review to ensure correctness.
Proof Key for Code Exchange (PKCE)
b) How may we expand the abbreviations below?
TPM
SIM
FAPI
SATMC
c) The abbreviation CIBA is expanded multiple times in the
document; in fact,
it is expanded every time it is used except for two instances.
Would you like
to expand the first instance in the text and then use the
abbreviation after?
-->
20) <!-- [rfced] Please review the "Inclusive Language" portion of
the online
Style Guide
<https://www.rfc-editor.org/styleguide/part2/#inclusive_language>
and let us know if any changes are needed. Updates of this nature
typically
result in more precise language, which is helpful for readers.
For example, please consider whether "native" and "traditional"
should be
updated throughout.
While the NIST website
<https://web.archive.org/web/20250214092458/https://www.nist.gov/nist-research-library/nist-technical-series-publications-author-instructions#table1>
indicates that "traditional" is potentially biased, it is also
ambiguous.
"Traditional" is a subjective term, as it is not the same for
everyone.
-->
Thank you.
Kaelin Foody and Rebecca VanRheenen
RFC Production Center
On Jul 30, 2026, at 9:38 PM, [email protected] wrote:
*****IMPORTANT*****
RFC Author(s):
--------------
Final Review for RFC-to-be 10027
<draft-ietf-oauth-cross-device-security>
Your document is now available for Final Review (previously
AUTH48). Once it has been
reviewed and approved by you and all coauthors, it will be
published as an RFC.
If an author is no longer available, there are several remedies;
see the Unavailable Authors section
(https://authors.ietf.org/rfc-publication-process#unavailable-authors).
You and you coauthors are responsible for engaging other parties
(e.g., Contributors or Working Group) as necessary before providing
your approval.
Planning your review
---------------------
Please review the following aspects of your document:
* RFC Editor questions
Please review and resolve any questions raised by the RFC Editor
that have been included in the XML file as comments marked as
follows:
<!-- [rfced] ... -->
These questions will also be sent in a subsequent email.
* Changes submitted by coauthors
Please ensure that you review any changes submitted by your
coauthors. We assume that if you do not speak up that you
agree to changes submitted by your coauthors.
* Content
Please review the full content of the document, as this cannot
change once the RFC is published. Please pay particular
attention to:
- IANA considerations updates (if applicable)
- contact information
- references
* Copyright notices and legends
Please review the copyright notice and legends as defined in
RFC 5378 and the Trust Legal Provisions
(TLP – https://trustee.ietf.org/license-info).
* Semantic markup
Please review the markup in the XML file to ensure that
elements of
content are correctly tagged. For example, ensure that
<sourcecode>
and <artwork> are set correctly. See details at
<https://authors.ietf.org/rfcxml-vocabulary>.
* Formatted output
Please review the PDF, HTML, and TXT files to ensure that the
formatted output, as generated from the markup in the XML file, is
reasonable. Please note that the TXT will have formatting
limitations compared to the PDF and HTML.
Submitting changes
------------------
To submit changes, please reply to this email using 'REPLY ALL' as
all
the parties CCed on this message need to see your changes. The
parties
include:
* your coauthors
* [email protected] (the RPC team)
* other document participants, depending on the stream (e.g.,
IETF Stream participants are your working group chairs, the
responsible ADs, and the document shepherd).
* [email protected], which is an archival mailing list
to preserve discussion about the document while in the RPC
editorial
queue; it is not an active discussion list:
* More info:
https://mailarchive.ietf.org/arch/msg/ietf-announce/yb6lpIGh-4Q9l2USxIAe6P8O4Zc
* The archive itself:
https://mailarchive.ietf.org/arch/browse/auth48archive/
* Note: If only absolutely necessary, you may temporarily
opt out
of the archiving of messages (e.g., to discuss a sensitive
matter).
If needed, please add a note at the top of the message
that you
have dropped the address. When the discussion is concluded,
[email protected] will be re-added to the CC list and
its addition will be noted at the top of the message.
You may submit your changes in one of two ways:
An update to the provided XML file
— OR —
An explicit list of changes in this format
Section # (or indicate Global)
OLD:
old text
NEW:
new text
You do not need to reply with both an updated XML file and an
explicit
list of changes, as either form is sufficient.
We will ask a stream manager to review and approve any changes
that seem
beyond editorial in nature, e.g., addition of new text, deletion
of text,
and technical changes. Information about stream managers can be
found in
the FAQ. Editorial changes do not require approval from a stream
manager.
Approving for publication
--------------------------
To approve your RFC for publication, please reply to this email
stating
that you approve this RFC for publication. Please use 'REPLY ALL',
as all the parties CCed on this message need to see your approval.
Files
-----
The files are available here:
https://www.rfc-editor.org/authors/rfc10027.xml
https://www.rfc-editor.org/authors/rfc10027.html
https://www.rfc-editor.org/authors/rfc10027.pdf
https://www.rfc-editor.org/authors/rfc10027.txt
Diff file of the text:
https://www.rfc-editor.org/authors/rfc10027-diff.html
https://www.rfc-editor.org/authors/rfc10027-rfcdiff.html (side by
side)
Alt-diff of the text (allows you to more easily view changes
where text has been deleted or moved):
https://www.rfc-editor.org/authors/rfc10027-alt-diff.html
Diff of the XML:
https://www.rfc-editor.org/authors/rfc10027-xmldiff1.html
Tracking progress
-----------------
Details on the status of your Final Review are here:
https://queue.rfc-editor.org/final-review/rfc10027/
Please let us know if you have any questions.
Thank you for your cooperation,
RFC Editor
--------------------------------------
RFC 10027 (draft-ietf-oauth-cross-device-security)
Title : Cross-Device Flows: Security Best Current Practice
Author(s) : P. Kasselman,
D. Fett,
F. Skokan
WG Chair(s) : Hannes Tschofenig, Rifaat Shekh-Yusef
Area Director(s) : Deb Cooley, Christopher Inacio
