Many thanks for the review, Christer. And thanks of the changes, Tiru. Jari
On 14 Feb 2015, at 00:44, Christer Holmberg <[email protected]> wrote: > Hi, > > I am the assigned Gen-ART reviewer for this draft. For background on Gen-ART, > please see the FAQ at > <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq> > > Document: > draft-ietf-tram-turn-third-party-authz-09.txt > > Reviewer: Christer Holmberg > > Review Date: 13 February 2015 > > IETF LC End Date: 4 January 2015 > > IETF Telechat Date: 19 February 2015 > > Summary: I see that there has been quite of bit of changes in the > draft since the previously reviewed version (-08). However, most of my > comments seem to have been addressed. But, I still have a few comments, most > related to my comments on the previously reviewed version. > > Major Issues: None > > Minor Issues: None > > Editorial nits: See below > > > > ------------- > > Section 1: > > Q1_2: Please add an OAuth reference on first occurrence. > > [TR] The latest version > http://tools.ietf.org/html/draft-ietf-tram-turn-third-party-authz-11 has > OAuth reference on first occurrence in the Introduction section. > > [Christer] True. My mistake. Comment withdrawn :) > > ------------- > > Section 4: > > > Q4_2: The section gives examples for the key establishment. I think you > should make it clear that, when you say that the mechanism to use is outside > the scope of the document, also should say the draft does not mandate any > given mechanism. > > [TR] Yes. > > Something like: > > “The procedure for establishment of the symmetric key is outside the > scope of this > specification, and this specification does not mandate support of any > given mechanism. > Sections 4.1.2, 4.1.2 and 4.1.3 show examples of mechanisms that can > be used.” > > > [TR] Updated draft with the above text. > > Section 4.1.2: > > Q4-1-2_1: Please add a reference to JSON on first occurrence. I see that > section 3 no longer mentions JSON. > > [TR] Added > > Q4-1-2_2: I suggest to add a reference to > [I-D.ietf-oauth-pop-key-distribution] also in this section, and indicate that > it defines the format of the JSON message. > > [TR] oauth-pop-key-distribution is specific to OAuth 2.0 token and keying > material distribution from authorization server to the client. > Added references to json drafts where these parameters are defined > > NEW: > > k - Long-term key (K) > exp - identifies the time after which the key expires. > > > example: > { > "k" : > "ESIzRFVmd4iZABEiM0RVZgKn6WjLaTC1FXAghRMVTzkBGNaaN496523WIISKerLi", > "exp" : 1300819380, > "kid" :"22BIjxU93h/IgwEb" > "enc" : A256CBC-HS512 > } > > The parameter "k" is defined in > Section 6.4.1 of [I-D.ietf-jose-json-web-algorithms], "enc" is > defined in Section 4.1.2 of [I-D.ietf-jose-json-web-encryption], > "kid" is defined in Section 4.1.4 of > [I-D.ietf-jose-json-web-signature] and "exp" is defined in > Section 4.1.4 of [I-D.ietf-oauth-json-web-token]. A256CBC-HS512 and > other authenticated encryption algorithms are defined in > [I-D.ietf-jose-json-web-algorithms]. In this case AS-RS key length > must be 256-bit, AUTH key length must be 256-bit (section 2.6 of > [RFC4868]). > > [Christer] Looks good. > > Thanks! > > Regards, > > Christer > _______________________________________________ > Gen-art mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/gen-art
signature.asc
Description: Message signed with OpenPGP using GPGMail
_______________________________________________ Gen-art mailing list [email protected] https://www.ietf.org/mailman/listinfo/gen-art
