Re: [kitten] draft-ietf-kitten-rfc4402bis-00 (was: Re: WGLC for three "bis" documents: draft-ietf-kitten-rfc4402bis-00, draft-ietf-kitten-rfc5653bis-01, draft-ietf-kitten-rfc6112bis-00)

[Shawn M Emery <[e-mail]>]

Thanks for your review, comments in-line...

On 02/13/15 11:16 AM, Benjamin Kaduk wrote:
> On Sun, 1 Feb 2015, Greg Hudson wrote:
>
>> On 01/20/2015 06:02 PM, Benjamin Kaduk wrote:
>>> http://tools.ietf.org/html/draft-ietf-kitten-rfc4402bis-00
>> I reviewed this and did not find any problems with it.
> I also did not find any substantive issues with it.  Some non-substantive
> issues are noted below.
>
>
> The reference for the Kerberos V GSS-API mechanism in section 1.1 seems to
> have changed from RFC 4121 to RFC 1964; is this a correct change?

Good catch.  The XML source obtained referenced this back when it was a 
draft.  I've updated accordingly.

>
> The RFC 2119 language conventions statement has been moved later in the
> document, after at least the first occurrence of "MUST".  It would be nice
> to have the RFC 2119 text before the first use of its keywords.

Yes, this is awkward.  I've updated accordingly.

> The original RFC 4402 security considerations include:
>
>     [...] if an
>     application can be tricked into providing very large input octet
>     strings and requesting very long output octet strings, then that may
>     constitute a denial of service attack on the application; therefore,
>     applications SHOULD place appropriate limits on the size of any input
>     octet strings received from their peers without integrity protection.
>
> It is not clear to me that integrity protection is sufficient to alleviate
> the denial of service attack, since verifying the message integrity may
> itself consume a substantial amount of resources.

I interpret this statement differently:

     If integrity protection is not enforced then an attacker can 
construct an arbitrarily long string.

> In the added text,
>
> % This document obsoletes RFC 4402 and reclassifies that document as
> % historic.  RFC 4402 starts the PRF+ counter at 1, however a number
> % implementations starts the counter at 0.  As a result, the original
>
> it should be "a number of implementations start" (add "of" and remove 's'
> from "starts") to be grammatical.
>
>
> Thanks again to Greg for supplying the test vectors.

...and also to Nico who verified the vectors in Heimdal.  Eventual 
shepherd should take note...

Shawn.
--