[TLS] [tls] Guidance for External PSK Usage in TLS

["Quick, Matthew" <[e-mail]>]

 

Hello Russ et al,

 

I hope this finds you well. Please find comments for “draft-ietf-tls-external-psk-guidance-03”, below. The document is well written and the latest revision has improved the clarity of presentation – no concerns with publication, only minor editorial comments. Your feedback is greatly appreciated. 

 

Best,

Matthew Quick, Verisign

 

____________________________

 2. Section 7, items 1 and 2

 

Justification:

Both use the acronym "EPSK" without defining it.

 

Existing text:

"EPSK"

 

Suggested text:

"external PSK" in both places, consistent with other uses throughout the document.

 

____________________________

3. Section 7, item 2:

 

Justification:

Editorial correction.

 

Existing text:

"PSKs know to a group".

 

Suggested text:

"PSKs known to a group".

 

____________________________

4. Section 4.1

 

Justification:

Items 2 and 3 respectively describe an attacker who can "read (and modify)" and "passively read (and actively modify)" traffic.  Unless "read" is meant to be different than "passively read," and "modify" differs from "actively modify,".

 

Suggested text:

Either dropping  "actively" and "passively" from item 3, or moving the terms to item 2 so they qualify "modify" and "read" on first use and thus extend to both uses.

 

____________________________

5. Section 8, paragraph 2

 

Justification:

Editorial correction.

 

Existing text:

"and uses it"

 

Suggested text:

"and use it" (matching change from "selects" to "to select")