Subject: [OAUTH-WG] Alexey Melnikov's Discuss on draft-ietf-oauth-amr-values-05: (with DISCUSS and COMMENT)

From: "Alexey Melnikov" <[email-masked]>
Date: Thu, 02 Feb 2017 00:05:46 -0800

Alexey Melnikov has entered the following ballot position for
draft-ietf-oauth-amr-values-05: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-oauth-amr-values/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

This is a fine document and I support its publication. However I have a
small set of issues that I would like to discuss first.

Are non ASCII names needed? (This is a protocol element, not a human
readable string, so non ASCII is not needed). Are ASCII spaces allowed in
names? More generally: what do you call printable character?

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

In Section 6.1: suggestion to first describe IANA registration policy,
then describe restrictions on registered names. Otherwise the current
text doesn't flow well.

I am also agreeing with Stephen's DISCUSS.

---

From: Mike Jones <[email-masked]>
Date: Thu, 2 Feb 2017 15:05:17 +0000

I'd be OK limiting the protocol elements to using ASCII characters, if that would be the IESG's preference.

-----Original Message-----
From: Alexey Melnikov [mailto:[email-masked]] 
Sent: Thursday, February 2, 2017 12:06 AM
To: The IESG <[email-masked]>
Cc: [email-masked]; Hannes Tschofenig <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Subject: Alexey Melnikov's Discuss on draft-ietf-oauth-amr-values-05: (with DISCUSS and COMMENT)

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)

This is a fine document and I support its publication. However I have a small set of issues that I would like to discuss first.

Are non ASCII names needed? (This is a protocol element, not a human readable string, so non ASCII is not needed). Are ASCII spaces allowed in names? More generally: what do you call printable character?

In Section 6.1: suggestion to first describe IANA registration policy, then describe restrictions on registered names. Otherwise the current text doesn't flow well.

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 02 Feb 2017 15:07:01 +0000

Hi Mike,

> that would be the IESG's preference.

I think that would be much simpler for everybody.

I still want to confirm that spaces are allowed in names. Can you
confirm?

> Cc: [email-masked]; Hannes Tschofenig
> <[email-masked]>; [email-masked];
> [email-masked]; [email-masked]

---

From: Mike Jones <[email-masked]>
Date: Thu, 2 Feb 2017 18:05:04 +0000

I was planning to stay with the characters specified in 6.1 (a) https://tools.ietf.org/html/draft-ietf-oauth-amr-values-05#section-6.1:

   a.  require that Authentication Method Reference values being
       registered use only printable ASCII characters excluding double
       quote ('"') and backslash ('\') (the Unicode characters with code
       points U+0021, U+0023 through U+005B, and U+005D through U+007E),

That excludes space.  That's the set taken from RFC 7638, Section 6 https://tools.ietf.org/html/rfc7638#section-6, which is a very related usage.

Space is excluded because sometimes in OAuth messages, values are represented as space-separated strings.

				-- Mike

-----Original Message-----
From: Alexey Melnikov [mailto:[email-masked]] 
Sent: Thursday, February 2, 2017 7:07 AM
To: Mike Jones <[email-masked]>; The IESG <[email-masked]>
Cc: [email-masked]; Hannes Tschofenig <[email-masked]>; [email-masked]; [email-masked]
Subject: Re: Alexey Melnikov's Discuss on draft-ietf-oauth-amr-values-05: (with DISCUSS and COMMENT)

Hi Mike,

I still want to confirm that spaces are allowed in names. Can you confirm?

> email addresses included in the To and CC lines. (Feel free to cut 
> this introductory paragraph, however.)
> 
> 
> Please refer to 
> https://www.ietf.org/iesg/statement/discuss-criteria.html
> This is a fine document and I support its publication. However I have 
> a small set of issues that I would like to discuss first.
> 
> readable string, so non ASCII is not needed). Are ASCII spaces allowed 
> in names? More generally: what do you call printable character?
> 
>

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 03 Feb 2017 10:16:12 +0000

On Thu, Feb 2, 2017, at 06:05 PM, Mike Jones wrote:
> I was planning to stay with the characters specified in 6.1 (a)
> https://tools.ietf.org/html/draft-ietf-oauth-amr-values-05#section-6.1:
> 
> That excludes space.  That's the set taken from RFC 7638, Section 6
> https://tools.ietf.org/html/rfc7638#section-6, which is a very related
> usage.
> 

I am sorry I misread this earlier: you already exclude space, so the
text as specified is fine.

> <[email-masked]>; [email-masked]; [email-masked]

---

From: Mike Jones <[email-masked]>
Date: Wed, 1 Mar 2017 02:17:07 +0000

Hi Alexey,

Draft -06 https://tools.ietf.org/html/draft-ietf-oauth-amr-values-06 restricts the character set to the printed subset of ASCII previously discussed.  It also addresses the readability concern you raised.  Finally, it adds references to address Stephen's point.

Thanks again for taking the time to produce your useful review.

				-- Mike

-----Original Message-----
From: Alexey Melnikov [mailto:[email-masked]] 
Sent: Friday, February 3, 2017 2:16 AM
To: Mike Jones <[email-masked]>; The IESG <[email-masked]>
Cc: [email-masked]; Hannes Tschofenig <[email-masked]>; [email-masked]; [email-masked]
Subject: Re: Alexey Melnikov's Discuss on draft-ietf-oauth-amr-values-05: (with DISCUSS and COMMENT)

> represented as space-separated strings.

I am sorry I misread this earlier: you already exclude space, so the text as specified is fine.

> > When responding, please keep the subject line intact and reply to 
> > all email addresses included in the To and CC lines. (Feel free to 
> > cut this introductory paragraph, however.)
> > 
> > 
> > Please refer to
> > This is a fine document and I support its publication. However I 
> > have a small set of issues that I would like to discuss first.
> > 
> > readable string, so non ASCII is not needed). Are ASCII spaces 
> > allowed in names? More generally: what do you call printable character?
> > 
> > 
> > In Section 6.1: suggestion to first describe IANA registration 
> > policy, then describe restrictions on registered names. Otherwise 
> > the current text doesn't flow well.
> >