Last Call Review of draft-ietf-ace-cwt-proof-of-possession-08

Request Review of draft-ietf-ace-cwt-proof-of-possession
Requested rev. no specific revision (document currently at 11)
Type Last Call Review
Team General Area Review Team (Gen-ART) (genart)
Deadline 2019-10-09
Requested 2019-09-25
Authors Michael Jones, Ludwig Seitz, Göran Selander, Samuel Erdtman, Hannes Tschofenig
Draft last updated 2019-10-04
Completed reviews Secdir Last Call review of -08 by Yoav Nir (diff)
Genart Last Call review of -08 by Christer Holmberg (diff)
Genart Telechat review of -09 by Christer Holmberg (diff)
Secdir Telechat review of -11 by Yoav Nir
Assignment Reviewer Christer Holmberg
State Completed
Review review-ietf-ace-cwt-proof-of-possession-08-genart-lc-holmberg-2019-10-04
Posted at
Reviewed rev. 08 (document currently at 11)
Review result Ready with Issues
Review completed: 2019-10-04


I am the assigned Gen-ART reviewer for this draft. The General Area
Review Team (Gen-ART) reviews all IETF documents being processed
by the IESG for the IETF Chair.  Please treat these comments just
like any other last call comments.

For more information, please see the FAQ at


Document: draft-ietf-ace-cwt-proof-of-possession-08
Reviewer: Christer Holmberg
Review Date: 2019-10-04
IETF LC End Date: 2019-10-09
IESG Telechat date: Not scheduled for a telechat

Summary: For most part the document is ready, but I have a few editorial comments and an issue.

Major issues: N/A

Minor issues:

The text says in the Security Considerations that one must ensure that the might not understand the "cnf" claim, and that applications
must ensure that receivers support it.

Q1: How are you going to ensure that, and why do you have to ensure that? RFC 8392 doesn't even seem to require that one must ensure that the receivers support CWT. 

Q2: For receivers that do support CWT, RFC 8392 says that unsupported claims must be discarded. If that can't be applied for "cnf" I think you need to explain why.

Nits/editorial comments:

Q_ED_1: Please use [RFC8392] instead of [CWT] when referencing to RFC 8392.

Q_ED_2: Shall CBOR be enhanced on first occurrence (in the Abstract or Introduction), or is it
on the list of well-known abbreviations?

Q_ED_3: Add a reference for CBOR map on first occurrence.

(I was looking in RFC 7049, and while it mentions maps in many places I could not find a proper definition for "CBOR map")