Subject: ID review: draft-ietf-krb-wg-naming-00

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 5 Jul 2006 02:24:27 -0700

1) section 1, I think this section can benefit from the following
rewrite:

   Occasionally protocol designers need to designate a Kerberos
   principal name or a Kerberos realm name to have special meanings,
   other than identifying a particular instance.  An example is that the
   the anonymous principal name and the anonymous realm name are defined
   for the Kerberos anonymity support [ANON]: this anonymity name pair
   conveys no more meaning than that the client's identity is not
   revealed.  In the case of the anonymity support, it is critical that
   deployed Kerberos implementations MUST fail the authentication if the
   anonymity name pair is used, therefore no access is granted
   accidentally to a principal who's name happens to match with that of
   the anonymous identity.

   However Kerberos as defined in [RFC4120] does not have such reserved
   names.  As such, protocol designers have resolved to use exceedingly-
   unlikely-to-have-been-used names to avoid collision.  Even if a
   registry were setup to avoid collision for new implementations, there
   is no collision-free guarantee for deployed implementations.
   Accidental reuse of names can result in a security weakness.

   The Kerberos realm name has a reserved name space but none is defined
   and the criticality of unknown reserved realm names is not specified.

   This document is to remedy that by defining reserved Kerberos names.
   These reserved names are critical: Authentication MUST fail if an
   unknown reserved name is used by conforming implementations.

2) section 3.2, first paragraph, the wording "as defined" is awkard,
perhaps it is preferable to break it into two parts.

189,191c187,189
<    A new reserved realm name type is defined.  This new name type is
<    defined as the "other" style of the realm names as defined in
Section
<    6.1 of [RFC4120].
---
>    A new realm type is defined for reserved realms.  This new realm
type
>    is defined in the "other" style of realm names, which is defined in
>    Section 6.1 of [RFC4120].

3) section 4, first paragraph, I think the sentence reads better if we
put a full stop after the "authentication MUST fail".

<    If a reserved name is unknown, authentication MUST fail, otherwise,
---
>    If a reserved name is unknown, authentication MUST fail.
Otherwise,