Last Call Review of draft-ietf-jmap-webpush-vapid-05
review-ietf-jmap-webpush-vapid-05-secdir-lc-dunbar-2024-12-09-00

I have reviewed this document as part of the SEC area directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the Security area directors.
Document editors and WG chairs should treat these comments just like any other
last-call comments.

Major issues:
The document does not introduce any new algorithms, protocols, or significant
extensions to JMAP, WebPush, or VAPID. There is a section on Key Rotation
Process which is specified in RFC8292. It seems that the document should be 
"Informational" instead of Standard track, correct?

The security considerations of the document seem to primarily reiterate general
concerns from related RFCs such as JMAP (RFC8620), WebPush (RFC8030), and VAPID
(RFC8292). However, the document appears to lack a detailed exploration of
security issues specific to the integration of VAPID with JMAP WebPush. Below
are potential security risks that deserve some discussion:

- The risk of race conditions if clients and servers are out of sync during the
key rotation process.

- The document does not address the potential risks associated with the
exposure of the urn:ietf:params:jmap:webpush-vapid property in the JMAP
capabilities object.

Best Regards,
Linda Dunbar