Re: WG Last Call: draft-ietf-sasl-scram-02

[Simon Josefsson <[e-mail]>]

I'll get to reviewing the technical part of the document, promise! :)

Running idnits on the document, it says

  == The document seems to lack a disclaimer for pre-RFC5378 work, but was
     first submitted before 10 November 2008.  Should you add the disclaimer?
     (See the Legal Provisions document at
     http://trustee.ietf.org/license-info for more information.). 

The document has a long history, is the current legal boilerplate ok?

Idnits also complains about these references, but these complaints seems
bogus:

  == Missing Reference: 'I-D.ietf-sasl-gs2' is mentioned on line 1014, but
     not defined

  == Missing Reference: 'RFC2743' is mentioned on line 1019, but not defined

  == Missing Reference: 'RFC4121' is mentioned on line 1025, but not defined

  == Missing Reference: 'RFC3962' is mentioned on line 1022, but not defined

  == Missing Reference: 'RFC4401' is mentioned on line 1030, but not defined

  == Missing Reference: 'RFC4402' is mentioned on line 1034, but not defined

  == Missing Reference: 'RFCXXXX' is mentioned on line 807, but not defined

However there are several documents added as references but not
mentioned in the document itself:

  == Unused Reference: 'I-D.ietf-sasl-rfc2831bis' is defined on line 1050,
     but no explicit reference was found in the text

  == Unused Reference: 'RFC2195' is defined on line 1055, but no explicit
     reference was found in the text

  == Unused Reference: 'RFC2202' is defined on line 1059, but no explicit
     reference was found in the text

  == Unused Reference: 'RFC4086' is defined on line 1065, but no explicit
     reference was found in the text

The first three should probably be just removed (?).  But the last one
seems useful to reference normatively.  How about adding the following
to Security Considerations?

  See [RFC4086] for more information about generating randomness.

/Simon