[EAI] AD review of draft-ietf-eai-pop-06

[Alexey Melnikov <[e-mail]>]

I am sorry I haven't followed Harald's request to post each issue in a 
separare message, but it is actually easier for me as an AD to track all 
issues in one place.

The document is in a good shape. I have mostly minor comments:

In Section 2:

>   The LANG command requests that human-readable text included in all
>   subsequent +OK and -ERR responses be localized to a language matching
>   the language range argument as described by [RFC4647].
>
I think this text needs to be clearer that it means "Basic Language 
Range" as defined in section 2.1 of RFC 4647.

> 3.1. The UTF8 Command
>
>    The octet count (size) of a message reported in a response to the
>    LIST command SHOULD match the actual number of octets sent in a RETR
>    response.  Sizes reported elsewhere, such as in STAT responses and
>    non-standardized free-form text in positive status indicators
>    (following "+OK") need not be accurate, but it is preferable if they
>    are.

I would like to hear some justification for returning inaccurate sizes 
(and for the SHOULD instead of a MUST).

> 3.2. USER Argument to UTF8 Capability
>
>    If the USER argument is included with this capability, it indicates
>    that the server accepts UTF-8 user names and passwords and applies
>    SASLprep [RFC4013] to the arguments of the AUTH, USER, PASS and APOP
>    commands.  A client that supports APOP and permits UTF-8 in user
>    names or passwords MUST also implement SASLprep [RFC4013] on the user
>    name and password used to compute the APOP digest.

I think the last sentence should read:

  A client that supports APOP and permits UTF-8 in user
   names or passwords MUST apply SASLprep [RFC4013] to the user
   name and password used to compute the APOP digest.

Also, the document is missing a statement about what should be done 
about Unicode characters disallowed by SASLPrep.
So, I would recommend adding the following sentence:

   The server MUST reject UTF-8 user names/password which fails to comply
   with the formal syntax in RFC 3629 [RFC3629] or if it encounters a 
Unicode
   characters listed in section 2.3 of RFC 4013 [RFC4013].

>    The client does not need to issue the UTF8 command prior to using
>    UTF8 in authentication.  However, clients MUST NOT use UTF8 in USER,
>    PASS, or APOP commands unless the USER argument is included with the
>    UTF8 capability.
>
>    Use of UTF8 in the AUTH command is governed by the SASL mechanism.

Should this have an Informative reference to RFC 4422?

As a side note: UTF-8 was always allowed in AUTH command, as support for 
it is required by SASL.