Re: [Extra] Benjamin Kaduk's No Objection on draft-ietf-extra-imap4rev2-27: (with COMMENT)

[Alexey Melnikov <[e-mail]>]

Hi Ben,

Thank you again for your extensive comments! Replying to a few more of 
your comments below:

On 04/02/2021 09:33, Benjamin Kaduk via Datatracker wrote:

> Section 8
>
>     The following is a transcript of an IMAP4rev2 connection on a non TLS
>     port.  A long line in this sample is broken for editorial clarity.
>
> More than one line, now.
>
> C:   A001 AUTHENTICATE SCRAM-SHA-256
>        biwsbj11c2VyLHI9ck9wck5HZndFYmVSV2diTkVrcU8=
> S:   + cj1yT3ByTkdmd0ViZVJXZ2JORWtxTyVodllEcFdVYTJSYVRDQWZ1eEZJbGopaE5s
>       RiRrMCxzPVcyMlphSjBTTlk3c29Fc1VFamI2Z1E9PSxpPTQwOTYNCg==
> C:   Yz1iaXdzLHI9ck9wck5HZndFYmVSV2diTkVrcU8laHZZRHBXVWEyUmFUQ0FmdXhG
>       SWxqKWhObEYkazAscD1kSHpiWmFwV0lrNGpVaE4rVXRlOXl0YWc5empmTUhnc3Ft
>       bWl6N0FuZFZRPQ==
> S:   + dj02cnJpVFJCaTIzV3BSUi93dHVwK21NaFVaVW4vZEI1bkxUSlJzamw5NUc0PQ==
>
> These correspond quite nicely to (base64'd copies of) the example in RFC
> 7677, with the exception of the first server line, that includes an
> additional CRLF in the decoded data.
Well spotted :-). Fixed.
> Section 11
>
> It might be worth putting in some bromide about how while md5 is used
> in the BODYSTRUCTURE response, the usage is not particularly security
> relevant and so there is not a vulnerability due to its use.
You suggested some text and I used a version of it. Thank you.
> Section 13.1
>
> It's not clear to me that [ANONYMOUS] is referenced in a manner that
> requires classification as normative; likewise for [SCRAM-SHA-256].

SCRAM has a SHOULD level requirement, even if conditional. I don't think 
it matters that much.

But I agree about ANONYMOUS.

> Similarly, if we use a modified form of [UTF-7] that we describe in
> whole ourselves, that does not seem to be normative.