IETF Last Call Review of draft-ietf-oauth-rfc8725bis-07
review-ietf-oauth-rfc8725bis-07-secdir-lc-turner-2026-07-30-00
| Request | Review of | draft-ietf-oauth-rfc8725bis |
|---|---|---|
| Requested revision | No specific revision (document currently at 07) | |
| Type | IETF Last Call Review | |
| Team | Security Area Directorate (secdir) | |
| Deadline | 2026-07-06 | |
| Requested | 2026-06-22 | |
| Authors | Yaron Sheffer , Dick Hardt , Michael B. Jones | |
| I-D last updated | 2026-07-22 (Latest revision 2026-07-18) | |
| Completed reviews |
Secdir IETF Last Call review of -07
by Sean Turner
Artart IETF Last Call review of -06 by Valery Smyslov (diff) Artart Telechat review of -07 by Valery Smyslov |
|
| Assignment | Reviewer | Sean Turner |
| State | Completed | |
| Request | IETF Last Call review on draft-ietf-oauth-rfc8725bis by Security Area Directorate Assigned | |
| Posted at | https://mailarchive.ietf.org/arch/msg/secdir/dFl_g8kDmf_3f9L6JnTp-4rUE8Y | |
| Reviewed revision | 07 | |
| Result | Has nits | |
| Completed | 2026-07-30 |
review-ietf-oauth-rfc8725bis-07-secdir-lc-turner-2026-07-30-00
Hi! Just two questions about Section 3.3: 1) Support for Nested JWTs is optional in RFC 7519. I think that's in line with the text in this section, but I wanted to check if you meant to have the pre-amble: If an implementation does support JWTs, then ... 2) RFC 7515 allows for multiple digital signatures and/or MACs for the same payload. Should this section or another specifically address those in addition to “Nested”.