Hi, I am the assigned Gen-ART reviewer for this draft. For background on Gen-ART, please see the FAQ at <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>
Document: draft-ietf-tram-turn-third-party-authz-09.txt Reviewer: Christer Holmberg Review Date: 13 February 2015 IETF LC End Date: 4 January 2015 IETF Telechat Date: 19 February 2015 Summary: I see that there has been quite of bit of changes in the draft since the previously reviewed version (-08). However, most of my comments seem to have been addressed. But, I still have a few comments, most related to my comments on the previously reviewed version. Major Issues: None Minor Issues: None Editorial nits: See below ------------- Section 1: Q1_2: Please add an OAuth reference on first occurrence. [TR] The latest version http://tools.ietf.org/html/draft-ietf-tram-turn-third-party-authz-11 has OAuth reference on first occurrence in the Introduction section. [Christer] True. My mistake. Comment withdrawn :) ------------- Section 4: Q4_2: The section gives examples for the key establishment. I think you should make it clear that, when you say that the mechanism to use is outside the scope of the document, also should say the draft does not mandate any given mechanism. [TR] Yes. Something like: "The procedure for establishment of the symmetric key is outside the scope of this specification, and this specification does not mandate support of any given mechanism. Sections 4.1.2, 4.1.2 and 4.1.3 show examples of mechanisms that can be used." [TR] Updated draft with the above text. Section 4.1.2: Q4-1-2_1: Please add a reference to JSON on first occurrence. I see that section 3 no longer mentions JSON. [TR] Added Q4-1-2_2: I suggest to add a reference to [I-D.ietf-oauth-pop-key-distribution] also in this section, and indicate that it defines the format of the JSON message. [TR] oauth-pop-key-distribution is specific to OAuth 2.0 token and keying material distribution from authorization server to the client. Added references to json drafts where these parameters are defined NEW: k - Long-term key (K) exp - identifies the time after which the key expires. example: { "k" : "ESIzRFVmd4iZABEiM0RVZgKn6WjLaTC1FXAghRMVTzkBGNaaN496523WIISKerLi", "exp" : 1300819380, "kid" :"22BIjxU93h/IgwEb" "enc" : A256CBC-HS512 } The parameter "k" is defined in Section 6.4.1 of [I-D.ietf-jose-json-web-algorithms], "enc" is defined in Section 4.1.2 of [I-D.ietf-jose-json-web-encryption], "kid" is defined in Section 4.1.4 of [I-D.ietf-jose-json-web-signature] and "exp" is defined in Section 4.1.4 of [I-D.ietf-oauth-json-web-token]. A256CBC-HS512 and other authenticated encryption algorithms are defined in [I-D.ietf-jose-json-web-algorithms]. In this case AS-RS key length must be 256-bit, AUTH key length must be 256-bit (section 2.6 of [RFC4868]). [Christer] Looks good. Thanks! Regards, Christer
_______________________________________________ Gen-art mailing list [email protected] https://www.ietf.org/mailman/listinfo/gen-art
