Re: [kitten] Roman Danyliw's No Objection on draft-ietf-kitten-krb-spake-preauth-11: (with COMMENT)

[Greg Hudson <[e-mail]>]

On 1/17/24 18:05, Roman Danyliw via Datatracker wrote:
> ** Section 2
>     This
>     mechanism uses a derivation similar to the second algorithm (SPAKE2)
>     with differences in detail.
> 
> What does “differences in detail” mean?

I will remove the clause "with differences in detail", as I think 
getting into the weeds doesn't make sense within a section on terminology.

> ** Section 2.  [SPAKE] needs to be a normative reference.  Likewise, as John
> Scudder mentioned, please improve the current reference text with a DOI pointer.

I disagree with the first part of this comment.  The referenced paper is 
an informative reference in RFC 9382, and is within the realm of 
cryptography research papers, not specifications.

> ** Section 12.1.1
> 
>     Reference:  URI or otherwise unique identifier for where the details
>        of this algorithm can be found.  It should be as specific as
>        reasonably possible.
> 
> Why is the Reference for "Kerberos Second Factor Types" defined as above but
> the “Kerberos SPAKE Groups” registry defines references (e.g., Specification,
> Serialization, etc) to as a “Reference to the definition ...).  Aren’t all of
> these entries some version of “Specification Required”?

A second factor type registration is expected to have an accompanying 
novel Kerberos-SPAKE-preauth-specific specification.  A group 
registration does not need such a new specification; as seen in the 
initial contents, it just needs a reference containing the group 
parameters such as [SEC1] or [SEC2].

> ** Appendix B.  Python needs a normative reference.

Appendix B is not part of the specification; it is only providing 
evidence that no one knows the discrete logs of the M and N parameters 
in the SPAKE group registration.  So I don't think a normative reference 
makes sense.

I'm happy to add an informative reference for Python if I can find an 
example, but I don't see such a reference in RFC 7748 or RFC 8032 (both 
of which contain Python code more central to the specification) or in 
any other RFC.