Re: [kitten] Comments on draft-ietf-kitten-krb-spake-preauth-00

["Henry B (Hank) Hotz, CISSP" <[e-mail]>]

> On Aug 14, 2017, at 11:01 AM, Greg Hudson <[e-mail]> wrote:
> 
> On 08/14/2017 01:30 PM, Henry B (Hank) Hotz, CISSP wrote:
>>>> [NIT] Section 4.3, para 2: Delete the word “Next”. On my first reading that led me to think it was describing what to do after “the client completes. . .”. It actually describes the *first* thing to do (in the third pass). I’ve now read it enough times that I’m no longer qualified to say how important that is.
>>> 
>>> The word "Next" is intended, but I can see that "will complete its part
>>> of the SPAKE process" is too vague--it is not clear that it is
>>> describing a computation step with no protocol messages.  I propose this
>>> wording, combining the first two paragraphs:
>>> 
>>>   Upon receipt of the challenge message, the client will complete
>>>   its part of of the SPAKE algorithm, generating a public key and
>>>   computing the shared secret K. Next, the client chooses one of the
>>>   second factor types [...]
>> 
>> Hmmm. I still wasn’t interpreting it right. If you say “next” I wonder what the preceding “first” or “next” was. I didn’t have an explicit referent to halt my mental search. In this case I think it’s:
> 
> Perhaps using "then" instead of next will help?  Current proposed
> wording (with some minor edits to the later sentences):
> 
>    Upon receipt of the challenge message, the client will complete
>    its part of of the SPAKE algorithm, generating a public key and
>    computing the shared secret K. The client will then choose one of
>    the second factor types listed in the factors field of the challenge
>    message and gather whatever data is required for the chosen second
>    factor type, possibly using the associated challenge data. Finally,
>    the client will send an AS-REQ containing a PA-SPAKE PA-DATA
>    element using the response choice.

That’s good. 

I did put the forward reference in because of what I said at the beginning of my last email, but I’m not hard over. I’m also no longer the best judge.  Any other opinions?

Personal email.  [e-mail]