[sipcore] AD Review: draft-ietf-sipcore-digest-scheme

[Adam Roach <[e-mail]>]

This is my AD review for draft-ietf-sipcore-digest-scheme.

First of all, I want to thank to everyone who put work into making
this happen. It's good to be putting in place a more secure
authentication mechanism.

I find no showstoppers in this version of the document, and will be 
requesting
IETF last call on it shortly. I did find some minor issues, described below,
that should be treated the same as any other last call comments.

/a

---------------------------------------------------------------------------

§1.1:

Please update to use the boilerplate in RFC 8174.

---------------------------------------------------------------------------

§2.5:

 >  The
 >  ordering of the header field values from the various proxies is not
 >  significant.

The phrasing here is a bit confusing, and can be read as contradicting the
sentence it follows. I believe what you mean to say can be conveyed with
something more like:

    The ordering of values received from proxies relative to values
    received from other proxies is not significant.

---------------------------------------------------------------------------

§2.6:

 >  1.  The URI included in the challenge has the following BNF:

Please cite RFC 5234.

---------------------------------------------------------------------------

§3:

 >  This opens the system to the potential of a downgrade attack by man-
 >  in-the-middle.

The phrasing here is a bit awkward. I might suggest rephrasing as:
"...a downgrade attack by an on-path attacker."