[Curdle] comments on draft-ietf-curdle-gss-keyex-sha2-03

[Daniel Migault <[e-mail]>]

Hi,

Please find my review for draft-ietf-curdle-gss-keyex-sha2-03 [1].

The corresponding shepherd write-up can be found here[2]. Feel free to
comment as well.


[1] https://tools.ietf.org/html/draft-ietf-curdle-gss-keyex-sha2-03
[2]
https://datatracker.ietf.org/doc/draft-ietf-curdle-gss-keyex-sha2/shepherdwriteup/

section 4, 5.2

I believe that "RECOMMENDED" and "OPTIONAL" can be removed and are
redundant with SHOULD / MAY.

References:

[FIPS-180-4] is referenced, but not mentioned in the text.

'NIST-SP-800-131Ar1' should be moved as informative references
in my opinion. The reference is provided to justify the rational,
not to describe the protocol.

ISO-IEC-8825-1 is a reference for ASN1. It seems to me that
informational is the right place.

[I-D.ietf-curdle-ssh-modp-dh-sha2] is now an RFC, I believe it
should be an informational document rather than a normative
document as it is only cited as an example to move from SHA1 to sha2.

RFC6194]  Polk, T., Chen, L., Turner, S., and P. Hoffman, "Security
Considerations for the SHA-0 and SHA-1 Message-Digest Algorithms"
should be in my opinion an informational reference.

It would be good to add a link to the IANA in the IANA section
registry and have it as an informational reference.

The draft mentions the SSH algorithm registry, but I am not
sure that is the correct registry. instead, the Key Exchange
Method Names registry might be more appropriated.


here is the output of the nits:

idnits 2.15.00

tmp/draft-ietf-curdle-gss-keyex-sha2-03.txt:

  Checking boilerplate required by RFC 5378 and the IETF Trust (see
  https://trustee.ietf.org/license-info)
  ----------------------------------------------------------------------------

     No issues found here.

  Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt:
  ----------------------------------------------------------------------------

     No issues found here.

  Checking nits according to https://www.ietf.org/id-info/checklist :
  ----------------------------------------------------------------------------

  ** The abstract seems to contain references ([RFC4462]), which it
     shouldn't.  Please replace those with straight textual mentions of the
     documents in question.

  -- The draft header indicates that this document updates RFC4462, but the
     abstract doesn't seem to directly say this.  It does mention RFC4462
     though, so this could be OK.


  Miscellaneous warnings:
  ----------------------------------------------------------------------------

  == Line 412 has weird spacing: '... string    out...'

  == Line 418 has weird spacing: '... string    ser...'

  == Line 430 has weird spacing: '... string    out...'

  == Line 443 has weird spacing: '... string    out...'

  == Line 457 has weird spacing: '... string    mic...'

  == (2 more instances...)

     (Using the creation date from RFC4462, updated by this document, for
     RFC5378 checks: 2005-08-23)

  -- The document seems to lack a disclaimer for pre-RFC5378 work, but may
     have content which was first submitted before 10 November 2008.  If you
     have contacted all the original authors and they are all willing to grant
     the BCP78 rights to the IETF Trust, then this is fine, and you can ignore
     this comment.  If not, you may need to add the pre-RFC5378 disclaimer.
     (See the Legal Provisions document at
     https://trustee.ietf.org/license-info for more information.)

  -- The document date (December 12, 2017) is 7 days in the past.  Is this
     intentional?


  Checking references for intended status: Proposed Standard
  ----------------------------------------------------------------------------

     (See RFCs 3967 and 4897 for information about using normative references
     to lower-maturity documents in RFCs)

  == Unused Reference: 'FIPS-180-4' is defined on line 637, but no explicit
     reference was found in the text

  -- Possible downref: Non-RFC (?) normative reference: ref. 'ANSI-X9-62-2005'

  -- Possible downref: Non-RFC (?) normative reference: ref. 'FIPS-180-4'

  == Outdated reference: A later version (-06) exists of
     draft-ietf-curdle-ssh-curves-04

  == Outdated reference: draft-ietf-curdle-ssh-modp-dh-sha2 has been
     published as RFC 8268

  -- Possible downref: Non-RFC (?) normative reference: ref. 'ISO-IEC-8825-1'

  -- Possible downref: Non-RFC (?) normative reference: ref.
     'NIST-SP-800-131Ar1'

  ** Downref: Normative reference to an Informational RFC: RFC 1321

  ** Downref: Normative reference to an Informational RFC: RFC 6194

  ** Downref: Normative reference to an Informational RFC: RFC 7546

  ** Downref: Normative reference to an Informational RFC: RFC 7748

  -- Possible downref: Non-RFC (?) normative reference: ref. 'SEC2v2'


     Summary: 5 errors (**), 0 flaws (~~), 9 warnings (==), 8 comments (--).

     Run idnits with the --verbose option for more detailed information about
     the items above.