<div dir="ltr">Thanks Mike, for bringing this to our attention.<div><br></div><div>My feeling is that in general SETs may be transported over insecure channels as long as they are secured to the extent required (signed, encrypted or both). However, in SET-push and SET-poll I don't see that situation arising. In both cases, a server-authenticated TLS transport can be reasonably expected.</div><div><br></div><div>Atul</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jun 9, 2020 at 12:50 PM Mike Jones via Openid-specs-risc <<a href="mailto:openid-specs-risc@lists.openid.net">openid-specs-risc@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-6693174560558347410WordSection1">
<p class="MsoNormal">There’s a discussion in the IETF SecEvent working group at present about whether to restrict SET delivery using the
<a href="https://tools.ietf.org/html/draft-ietf-secevent-http-push-11" target="_blank">draft-ietf-secevent-http-push</a> and
<a href="https://tools.ietf.org/html/draft-ietf-secevent-http-poll-10" target="_blank">draft-ietf-secevent-http-poll</a> specs to only allow delivery over HTTPS (TLS) connections. At present, it’s unclear whether pure HTTP is also allowed. The specs do say that if SETs are
delivered over a channel that doesn’t provide integrity protection, that they must be signed and/or encrypted to provide this protection.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The discussion is happening in the thread “Re: [Id-event] Genart last call review of draft-ietf-secevent-http-poll-09”. Given that this working group is using the SET delivery specs, I wanted to bring this choice that will be made soon
to your attention.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> -- Mike<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
_______________________________________________<br>
Openid-specs-risc mailing list<br>
<a href="mailto:Openid-specs-risc@lists.openid.net" target="_blank">Openid-specs-risc@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-risc" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-risc</a><br>
</blockquote></div>