Subject: Last Call - draft-ietf-krb-wg-ocsp-for-pkinit-02.txt

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 30 Nov 2004 15:46:19 -0500

The authors of the OCSP-for-PKINIT document have informed me that they 
believe this document is ready for a last call.  I have reviewed the 
document, and aside from a number of editorial issues, I agree.

I am therefore starting 2-week Working Group Last Call on:

  OCSP Support for PKINIT
  draft-ietf-krb-wg-ocsp-for-pkinit-02.txt

to determine whether it is the consensus of this working group to
submit the document to the IESG for consideration as a Proposed Standard.

This Last Call will expire on 14-Dec-2004

Please send comments on this document to [email-masked]

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Co-chair, IETF Kerberos Working Group
   Carnegie Mellon University - Pittsburgh, PA

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 30 Nov 2004 16:51:08 -0500

Below are my own comments on this document...

WG Chair review for draft-ietf-krb-wg-ocsp-for-pkinit-02.txt
Reviewed by Jeffrey Hutzelman, 30-Nov-2004

Old document versions, inter-version diffs, and idnits output are all
available at http://ietf.levkowetz.com/drafts/krb-wg/ocsp-for-pkinit/

- The acronym "OCSP" is used in the abstract, and must be expanded
  there.  It still _also_ needs to be expanded the first time it is
  used in the main text -- the abstract must be completely separable
  from the main body, so there are no dependencies in either direction.

- The abstract currently begins as follows:

  > This document defines a mechanism to enable in-band transmission of
  > OCSP responses.

  add "... in the Kerberos network authentication protocol".  Without
  this, the abstract is too vague.

- The acronym "KDC" must be expanded on first use (expand it as
  "Kerberos Key Distribution Center")

- Section 3 asserts PA-PK-OCSP-RESPONSE is 16.  Don't do this unless
  that is the number you got from Cliff.

- You appear to describe the format of PA-PK-OCSP-RESPONSE using
  ASN.1, but you do not specify which encoding is to be used, and
  normative references to the relevant ASN.1 specifications are
  missing.

- Note that if you use ASN.1, it must actually compile.

- "The KDC that receives a PA-PK-OCSP-RESPONSE the SHOULD send..."
  s/the SHOULD send/then SHOULD send/

- "verification of the validity of the OCSP servers MAY need to be done"
  MAY is requirements language; it is used to indicate things that a
  server is allowed to do.  If you say something "MAY need to be done",
  the implication is that sometimes it is required.  Rephrase this as
  "MAY be done", which indicates the server can do whatever it wants.

- Section 4 says "MUST be used in conjunction with PKINIT".
  This is normative requirements language; it means that this document
  can be used only in conjunction with PKINIT and not in any other
  circumstances.  That is fine, except
  (a) it makes the PKINIT reference normative
  (b) requirements should not appear for the first time in the
      security considerations section.

  Either drop this MUST, or move it earlier in the document, possibly
  even to the introduction.  Either way, it is appropriate for the
  security considerations section to point out that this pa-type does
  not authenticate anything.

- Section 5 implies (but fails to clearly state) that IANA needs to
  assign a Kerberos preauth type for this.  This will only confuse
  them, as the registry of preauth types has not yet been turned
  over to the IANA.  Instead, you should obtain a preauth type from
  Cliff Neuman <[email-masked]>, and note that no IANA actions are
  required for this document.

- References must be split into separate sections for normative and
  informative references; these should be titled "Normative References"
  and "Informative References", respectively, and should appear in
  that order.

idnits 1.49

ocsp-for-pkinit/draft-ietf-krb-wg-ocsp-for-pkinit-02.txt:

  The document seems to lack separate sections for Informative/Normative 
References
  Checking conformance with RFC 3667/3668 boilerplate...
  the boilerplate looks good.

  Summary: 1 nits