Hi Donald,
Responses below.
-----Original Message-----
From: Donald Eastlake [mailto:[email protected]]
Sent: Sunday, December 27, 2015 4:31 PM
To: Peter Yee
Cc: [email protected]; [email protected] Review Team; IETF
Discussion
Subject: Re: Gen-ART LC review of draft-ietf-dnsop-cookies-08
>> Minor issues:
>>
>> Page 14, Section 5.2.4, 1st paragraph, 1st sentence: It might be
>> useful to mention what the examination entails as it would help in
>> understanding the 3rd sentence in the paragraph. There's an implied
>> recalculation of the Server Cookie value based on the received Client
>> Cookie and client IP address as opposed to a simple lookup of the received
>> value.
>I'm not so sure of that. If the server wanted to, it could generate a random
>Server Cookie for each {Client Cookie, Client IP} and, in fact, do a look up.
Section 5.2.4 is the invalid server cookie one. Let's say just the client's
cookie changed, but all else remained the same. The server wants to do a
lookup. If it looks up a stored, expected server cookie based on the client IP
address, the server cookie looks valid. If it just takes the received client
cookie and client IP address (plus server secret) and generates the expected
cookie value, then the received server cookie will appear invalid because of
the change in client cookie. That's the line of thinking that led to my
comment. It appears that you're expecting to do the calculation, otherwise you
wouldn't have reason to notice the client cookie changing since this is an
examination of the server cookie. Sure, you could index off the client cookie,
but that seems extreme. And you would presumably not update the server cookie
value to be used in future responses until you've done the initial examination,
so you unless you're doing an involved cookie rollover scheme, the c
lient cookie wouldn't be used until it's needed to create the updated server
cookie.
>> Nits:
>> Page 13, Section 5.2.2, 2nd paragraph: append "bytes" after "40".
>Why after 40 but not after 8 or 16? Seems like me it would be an improvement
>to add "bytes" after all three.
That works for me too. I just wanted to get the unit in there. If you prefer
to tie the unit to each value, that's fine.
>Thanks,
>Donald
My pleasure,
-Peter
_______________________________________________
Gen-art mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/gen-art
