Last Call Review of draft-ietf-ace-cwt-proof-of-possession-08
review-ietf-ace-cwt-proof-of-possession-08-secdir-lc-nir-2019-10-06-00

• Status
• Email expansions
• History

• Versions
• 00

Review
review-ietf-ace-cwt-proof-of-possession-08-secdir-lc-nir-2019-10-06

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

I think the document shows that security aspects have been considered and handled well. However, the document has issues with clarity and readability:

For starters, the Abstract and Introduction are nearly identical. The Introduction could instead be used to explain the domain, who the "players" are and what they are trying to accomplish. Instead, section 2 introduces the terms Issuer, Presenter and Recipient with definitions that sound like the CA, the End Entity and the Relying Party from PKI, with a little OAuth terminology mixed in. There is no explanation about who this issuer is, and what the trust model is.

The Security Considerations section also has some problems.  Quoting the second paragraph:
   Applications utilizing proof of possession SHOULD also utilize
   audience restriction, as described in Section 3.1.3 of [CWT], as it
   provides additional protections.  Audience restriction can be used by
   recipients to reject messages intended for different recipients.

Why? Why is the aud claim needed with a cnf claim (but not in other cases)?  Neither this document nor RFC 8392 provides insight as to when aud is appropriate. That they allow recipients to reject messages not intended for them does not sound like a security feature.

Paragraph 3 says: "A recipient might not understand the "cnf" claim."   This re-affirms that we need an explanation of who the parties to this protocol are. We generally don't send messages to recipients that don't understand them. Is this a closed system with known entities, or is this a protocol where the parties contact random other parties on the Internet?

I'd also lose some of the Introduction to Crypto in the second-to-last paragraph.