Re: WG Last Call: draft-ietf-sasl-crammd5-08.txt

[Alexey Melnikov <[e-mail]>]

Tom Yu wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>This message commences a Working Group Last Call on the following
>document:
>
>	Title		: The CRAM-MD5 SASL Mechanism
>	Author(s)	: L. Nerenberg
>	Filename	: draft-ietf-sasl-crammd5-08.txt
>	Pages		: 10
>	Date		: 2007-3-7
>  
>
Hi Lyndon,
You've already spotted an inconsistent comment in section 3:

     username   = 1*OCTET
                  ; MUST be well-formed UTF-8.


In section 4:

   The client SHOULD prepare the user name and shared secret strings
   using the SASLprep [RFC4013] profile of the Stringprep [RFC3454]
   algorithm.  The resulting values SHOULD be encoded as UTF-8 [RFC3629]

The second quoted sentence seems to imply that the resulting value should be in UTF-8 only if SASLPrep is applied to it.
I think that use of UTF-8 should be recommended even if SASLPrep is applied (which is likely the common case these days).

   strings.  The server may store the prepared string instead of, or as
   well as, the unprepared string, so that it does not have to prepare
   it every time it is needed for computation.  However, if the original
   (unprepared) string is not stored, it may render the computed secret
   to be incompatible with a future revisions of SASLprep that support
   currently unassigned code points (see section 7 of [RFC3454]).  It is
   therefor recommended to store the unprepared string in the database.


Some other comments:

 I've checked ABNF with Bill Fenner's parser and it passes (not really 
surprised).

Some errors reported by IDnits 2.03.15:

>  Checking nits according to http://www.ietf.org/ID-Checklist.html:
>  * The document seems to lack a both a reference to RFC 2119 and the
>    recommended RFC 2119 boilerplate, even if it appears to use RFC 2119
>    keywords. 
>  
>
Indeed. The reference to RFC 2119 is missing.

>    RFC 2119 keyword, line 93: '...ts).  The client MUST NOT interpret or a...'
>    RFC 2119 keyword, line 103: '...   server MUST ensure the right-most spa...'
>    RFC 2119 keyword, line 124: '...               ; MUST be well-formed UTF...'
>    RFC 2119 keyword, line 148: '...   The client SHOULD prepare the user na...'
>    RFC 2119 keyword, line 150: '...   algorithm.  The resulting values SHOULD be encoded as UTF-8 [RFC3629]...'
>    (1 more instance...)
>  
>
 [...]

>  Checking references for intended status: Proposed Standard
>  - Unused Reference: 'RFC4616' is defined on line 259, but not referenced
>  
>
This reference is not needed, as the text that was comparing CRAM-MD5 
with PLAIN got deleted.

>  - Obsolete informational reference (is this intentional?): RFC 2095
>
Indeed, use RFC 2195 instead.