Re: [kitten] WGLC for three "bis" documents: draft-ietf-kitten-rfc4402bis-00, draft-ietf-kitten-rfc5653bis-01, draft-ietf-kitten-rfc6112bis-00

[Benjamin Kaduk <[e-mail]>]

On Sun, 1 Feb 2015, Greg Hudson wrote:

> On 01/20/2015 06:02 PM, Benjamin Kaduk wrote:
> > http://tools.ietf.org/html/draft-ietf-kitten-rfc4402bis-00
>
> I reviewed this and did not find any problems with it.

I also did not find any substantive issues with it.  Some non-substantive
issues are noted below.


The reference for the Kerberos V GSS-API mechanism in section 1.1 seems to
have changed from RFC 4121 to RFC 1964; is this a correct change?


The RFC 2119 language conventions statement has been moved later in the
document, after at least the first occurrence of "MUST".  It would be nice
to have the RFC 2119 text before the first use of its keywords.


The original RFC 4402 security considerations include:

   [...] if an
   application can be tricked into providing very large input octet
   strings and requesting very long output octet strings, then that may
   constitute a denial of service attack on the application; therefore,
   applications SHOULD place appropriate limits on the size of any input
   octet strings received from their peers without integrity protection.

It is not clear to me that integrity protection is sufficient to alleviate
the denial of service attack, since verifying the message integrity may
itself consume a substantial amount of resources.


In the added text,

% This document obsoletes RFC 4402 and reclassifies that document as
% historic.  RFC 4402 starts the PRF+ counter at 1, however a number
% implementations starts the counter at 0.  As a result, the original

it should be "a number of implementations start" (add "of" and remove 's'
from "starts") to be grammatical.


Thanks again to Greg for supplying the test vectors.

-Ben