Thanks for the discussion, Stephen.
To your point about "otp", the working group discussed this very point. They
explicitly decided not to introduce "hotp" and "totp" identifiers because no
one had a use case in which the distinction mattered. Others can certainly
introduce those identifiers and register them if they do have such a use case,
once the registry has been established. But the working group wanted to be
conservative about the identifiers introduced to prime the registry, and this
is such a case.
What identifiers to use and register will always be a balancing act. You want
to be as specific as necessary to add practical and usable value, but not so
specific as to make things unnecessarily brittle. While some might say there's
a difference between serial number ranges of particular authentication devices,
going there is clearly in the weeds. On the other hand, while there used to be
an "eye" identifier, Elaine Newton of NIST pointed out that there are
significant differences between retina and iris matching, so "eye" was replaced
with "retina" and "iris". Common sense informed by actual data is the key here.
The point of the registry requiring a specification reference is so people
using the registry can tell where the identifier is defined. For all the
initial values, that requirement is satisfied, since the reference will be to
the new RFC. I think that aligns with the point that Joel was making.
Your thoughts?
-- Mike
-----Original Message-----
From: OAuth [mailto:oauth-boun...@ietf.org] On Behalf Of Stephen Farrell
Sent: Wednesday, February 1, 2017 7:03 AM
To: joel jaeggli <joe...@bogus.com>; The IESG <i...@ietf.org>
Cc: oauth-cha...@ietf.org; draft-ietf-oauth-amr-val...@ietf.org; oauth@ietf.org
Subject: Re: [OAUTH-WG] Stephen Farrell's Discuss on
draft-ietf-oauth-amr-values-05: (with DISCUSS)
On 01/02/17 14:58, joel jaeggli wrote:
> On 1/31/17 8:26 AM, Stephen Farrell wrote:
>> Stephen Farrell has entered the following ballot position for
>> draft-ietf-oauth-amr-values-05: Discuss
>>
>> When responding, please keep the subject line intact and reply to all
>> email addresses included in the To and CC lines. (Feel free to cut
>> this introductory paragraph, however.)
>>
>>
>> Please refer to
>> https://www.ietf.org/iesg/statement/discuss-criteria.html
>> for more information about IESG DISCUSS and COMMENT positions.
>>
>>
>> The document, along with other ballot positions, can be found here:
>> https://datatracker.ietf.org/doc/draft-ietf-oauth-amr-values/
>>
>>
>>
>> ---------------------------------------------------------------------
>> -
>> DISCUSS:
>> ---------------------------------------------------------------------
>> -
>>
>> This specification seems to me to break it's own rules. You state
>> that registrations should include a reference to a specification to
>> improve interop.
>> And yet, for the strings added here (e.g. otp) you don't do that
>> (referring to section 2 will not improve interop) and there are
>> different ways in which many of the methods in section 2 can be done.
>> So I think you need to add a bunch more references.
>
> Not clear to me that the document creating the registry needs to
> adhere to the rules for further allocations in order to prepoulate the
> registry. that is perhaps an appeal to future consistency.
Sure - I'm all for a smattering of inconsistency:-)
But I think the lack of specs in some of these cases could impact on interop,
e.g. in the otp case, they quote two RFCs and yet only have one value. That
seems a bit broken to me, so the discuss isn't really about the formalism.
S.
>>
>>
>>
>
>
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
