[sipcore] Doc Shepherd review of draft-ietf-sipcore-digest-scheme, cont.

["A. Jean Mahoney" <[e-mail]>]

Hi Rifaat,

Below are the rest of my Doc Shepherd review comments, mainly a few 
minor issues and nits. I have a suggested rework of the Introduction to 
clarify that MD5 is not collision resistant and that RFC3261 references 
the RFC obsoleted by RFC7616.

Thanks!

Jean


General: There are some instances of "SIP protocol" and "HTTP protocol". 
These should be replaced with either "SIP"/"HTTP" or "Session Initiation 
Protocol"/"Hypertext Transfer Protocol".

Abstract:  Should explicitly mention that the document updates RFC 3261 
(idnits flagged this). Should mention that MD5 is still available for 
backward availability.

Introduction:  Suggested rewording -

    The Session Initiation Protocol [RFC3261] uses the same mechanism
    that the Hypertext Transfer Protocol (HTTP) uses for authenticating
    users. This mechanism is called Digest Access Authentication, and
    it is a simple challenge-response mechanism that allows a server
    to challenge a client request and allows a client to provide
    authentication information in response to that challenge. The
    version of Digest Access Authentication that RFC 3261 references
    is specified in [RFC2617].

    The default hash algorithm for Digest Access Authentication is MD5.
    However, it has been demonstrated that the MD5 algorithm is not
    collision resistant, and is now considered a bad choice for a hash
    function [RFC6151].

    The HTTP Digest Access Authentication [RFC7616] document obsoletes
    [RFC2617] and adds stronger algorithms that can be used with
    the Digest Authentication scheme, and establishes a registry for
    these algorithms, known as the "Hash Algorithms for HTTP Digest
    Authentication" registry, so that algorithms can be added in the
    future.

    This document updates the Digest Access Authentication scheme used
    by SIP to support the algorithms listed in the "Hash Algorithms
    for HTTP Digest Authentication" registry defined by [RFC7616].


S2 p2:    This section should also mention that the BNF for the URI
           included in the challenge has been changed and now allows
           more schemes than SIP and SIPS.

S2 p2:    UAC and UAS should be expanded on first use.

S2 p2:    s/"qop" option/"qop" parameter

S2.1 p2:  s/any registered algorithm/any algorithm listed in
           the "Hash Algorithms for HTTP Digest Authentication"
           registry.

S2.4 p1:  Remove the space in "Proxy- Authenticate"

S2.5 p1:  s/introduces some clarification to that/clarifies that

S2.5 p2:  s/proxy to the UA./proxy to the UAC.

S2.6:     I suggest changing the title to "HTTP Digest Authentication
           Scheme Modifications" to match better the section title
           in RFC 3261.

S2.6 p1:  There is also a change to the BNF in bullet 1 that allows
           more URI schemes, so "... specified in bullets, 1, 7 and 8."

S2.6 p3:  Add a reference to RFC7616 after HTTP.

S2.6 #8:  s/handle "qop"/handle the "qop" (occurs twice)

S2.6 last p: s/continue/continues

S2.7 p1:  Insert a reference to [RFC5234] after "Augmented BNF".

S3 p1:    s/used to with/used with

S4 p1:    Add an explicit statement such as, "This document has
           no actions for IANA."

S6:       Add references to RFC 5234 and RFC 6151.