Re: [secdir] secdir review of draft-ietf-kitten-rfc6112bis-02

[Shawn M Emery <[e-mail]>]

On 11/ 7/16 04:16 PM, Carl Wallace wrote:
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
> These comments were written primarily for the benefit of the security area
> directors.  Document editors and WG chairs should treat these comments
> just like any other last call comments.
>
> draft-ietf-kitten-rfc6112bis-02 is an update that obsoletes RFC 6112. It's
> a copy of 6112 with a few corrections, some word-smithing and a small
> amount of new text. A few minor comments are below:
>
> - RFC6112 should appear in the bibliography.

Done.

> - I'd add a few more items to section 1.1 (changes since 6112) to call out
> the corrections to type names from RFC4556 and highlight the
> KeyExchange->KEYEXCHANGE change. Rationale for the MUST->SHOULD change
> might be nice here too.

I've updated the section according to your suggestions:

--
In Section 7, the pepper2 string, "KeyExchange", is corrected to comply 
with the string actually used by implementations.

The requirement for the anonymous option to be used when an anonymous 
ticket is used in a TGS request is reduced from a MUST to a SHOULD.  At 
least one implementation does not require this and is not necessary that 
both be used as an indicator of request type.

Corrected the authorization data type name, AD-INITIAL-VERIFIED-CAS, 
referenced in this document.
--

Does this clarify the changes?

> - The IANA considerations section was right in 6112, but probably doesn't
> belong here (at not least as defining a 'new' well-known name).

I've taken out the words 'new' from this section.

Thanks for your review and I've made the recommended updates in the next 
version of the draft.

Shawn.
--