Re: [secdir] Resend: Secdir review of draft-altman-tls-channel-bindings-10

[Nicolas Williams <[e-mail]>]

On Tue, May 04, 2010 at 10:42:59PM -0700, Magnus Nyström wrote:
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the security area
> directors.  Document editors and WG chairs should treat these comments just
> like any other last call comments.

Thanks.

> Two of my comments from my review of -07 still stands:
> 
> 1. Section 2 should reference RFC 5056, not RFC 5246. This is a bug.

Noted many, many times :)  There's a note to the RFC-Editor; it will get
fixed!

> 2. It would have been nice with an example of an authentication mechanism
> using one of the channel bindings in this document, perhaps in the form of
> an illustrative appendix.

Now that SCRAM is on the RFC-Editor queue I suppose we could lift the
examples from there and add TLS message descriptions to make a complete
example, but I don't really care to provide actual keys, randoms, key
derivations, ... -- ENOTENOUGHTIME.  We could also do the same with
Kerberos, but the examples would be even more opaque.  I might draft
something, but if it'd require another last call then I'd rather file an
I-D, seeking publication as Informational, to provide the examples.

Thanks,

Nico
--