[CFRG] New version of CPace draft available. Plans for next steps editorial steps for final release.

[Björn Haase <[e-mail]>]

Dear CFRG, dear CFRG chairs,

we have just uploaded revision 13 of  draft-irtf-cfrg-cpace .

We have carefully reviewed the CPace draft and we have incorporated all of
the (valuable !) feedback from Thomas, Khartik and Björn.

There were two main concerns with the draft prior to the crypto panel
review:
- Breaking the abstraction levels:

   The previous drafts referred to the way the data is encoded for
transfer over
   the network (network_encode() function). We now have removed the
corresponding
   references and made the session key calculation independent on
network encoding.
   This generates some minor additional overhead when integrating CPace
in protocols
   such as TLS but will avoid headaches with integration tests and
inter-operability.
   We think that with the changes we have now considered the main big
point brought up
   by Thomas.

- The session id topic (sid pre-agreement mandatory?):
   There has been a recent analysis exactly studying this aspect
published at the crypto2024
conference. We now have incorporated the results in the draft.
   That was the main concern brought up by Khartik.

FYI: For keeping track of all the review comments we have setup a file at
https://github.com/cfrg/draft-irtf-cfrg-cpace/blob/master/TODO_review
<https://github.com/cfrg/draft-irtf-cfrg-cpace/blob/master/TODO_review>where
we
have copied the original reviewer feedback text (with preceeding #) and
where we have added our corresponding responses after integrating
the feedback into the draft (preceeded with >).

We believe that there might still be a bit of editorial work left for
meeting all
formal requirements for an RFC but we also did our very best with
meeting all formal
requirements. Also a language pass by a native speaker might be helpful.

@Chairs: Could you please give us some guidance about your recommended
next steps for proceding towards a released RFC?


Yours,

Julia, Michel and Björn

--
Diese E-Mail wurde von AVG-Antivirussoftware auf Viren geprüft.
www.avg.com