[Gen-art] Re: Gen-art review of draft-ietf-radext-rfc4590bis-01.txt

On Tue, 22 May 2007, 1:57pm, Gonzalo Camarillo wRote:

> Hi,
>
> I have been selected as the General Area Review Team (Gen-ART)
> reviewer for this draft (for background on Gen-ART, please see
> http://www.alvestrand.no/ietf/gen/art/gen-art-FAQ.html).
>
> Please resolve these comments along with any other Last Call comments
> you may receive.
>
>
> Draft: draft-ietf-radext-rfc4590bis-01.txt
> Reviewer: Gonzalo Camarillo <Gonzalo.Camarillo@ericsson.com>
> Review Date: 22 May 2006
>
> Summary:
>
> This draft is ready for publication as a PS RFC.
>
>
> Comments:
>
> RFC 3579, which appears in the References, is an Informational RFC
> (i.e., it is a down reference).

Meaning this should appear in section 9.2 instead of 9.1?  Or that the 
text should some somehow refer back to some standard reference versus 
rfc3579.  Sorry for my ignorant question.

>
> Section 2.1 explains that information sent over a TLS connection to the
> RADIUS client may be sent in cleartext to the RADIUS server, but does
> not give any recommendation on what to do in that case. A further
> explanation or a recommendation would be useful.

This is discussed more in Section 8.2.   What is the best way to approach 
this, prehaps by adding a sentence to the end of the paragraph like:

"2.1 RADIUS Client Behavior

The attributes described ..... result in information 
intentionally protected by HTTP-style clients being sent in the clear 
during RADIUS exchange.  Ways to mitigate this exposure are discussed in 
section 8.2"

Or is it prefered to summarize the problem in section 2.1.

thanks,
-david

>
>
> Thanks,
>
> Gonzalo
>

_______________________________________________
Gen-art mailing list
Gen-art@ietf.org
https://www1.ietf.org/mailman/listinfo/gen-art