Subject: WGLC comments on draft-ietf-krb-wg-naming-03.txt

From: Jeffrey Hutzelman <[email-masked]>
Date: Sun, 25 Mar 2007 17:39:10 -0400 (EDT)

In the process of reviewing the latest version of the naming draft, I
found the following issues.  Some of these are not new in this version of
the draft, but have also not been named before.  I hope that most of these
will be non-controversial.

+ Abstract could be better phrased, and needs to note that RFC4120 is
  updated.  Suggest the following new text:

     This document updates RFC 4120 to reserve a class of "well-known"
     Kerberos principal names and to define a new Kerberos realm type for
     "well-known" realm names.

+ The use of RFC2119 "MUST" in the first paragraph is inappropriate, and
  "therefore" and "who's" are used incorrectly.  Suggest removing the
  word "MUST", replacing "therefore" by "so that", and replacing "who's"
  by "whose"

+ Why do we say that a well-known realm MUST NOT appear in the transited
  field?  This would seem to imply that a TGS issuing a ticket to a
  foreign client should not update the transited field if the nearest
  realm happens to have a well-known realm name.  Surely this is not what
  is intended -- if a realm name is not intended for cross-realm use, it
  will never appear in that context, and no prohibition is necessary.  If
  it is used in such a context, surely we want the default behavior to
  continue to be to construct a complete transited path, which is what
  RFC1510 and RFC4120 implementations will do.

  I suggest changing "MUST NOT be present" to "is not normally present" in
  the last paragraph of section 3.2.

+ My first name is misspelled in the acknowledgements section (the correct
  spelling is -r-e-y, not -e-r-y).

+ The IANA considerations section does not adequately describe the contents
  of the registries to be created, and does not carefully describe which
  values may be registered.  I suggest replacing the entire section with
  the following:

    A new registry is created for Kerberos well-known principal names,
    with a registration policy of "Specification Required", as defined
    in [RFC2434].  Each entry should specify the principal name or
    names to be allocated, written as described in [RFC1964] section
    2.1.1 (1).  As specified in section 3.1, the first component of
    these names must be the literal string "WELLKNOWN".  Note that
    principal names are restricted to US-ASCII; see [RFC4120] section
    5.2.1.  A single entry may allocate a class of principal names,
    such as "WELLKNOWN/FOO/*", meaning "all names whose first two
    components are "WELLKNOWN/FOO".  Each entry should also indicate
    what the allocation is for and include a pointer to the relevant
    RFC or other specification.

    A new registry is created for Kerberos well-known realm names,
    with a registration policy of "Specification Required", as defined
    in [RFC2434].  Each entry should specify the realm name or names
    to be allocated, which must begin with "WELLKNOWN:" as specified
    in section 3.2.  Note that realm names are restricted to US-ASCII;
    see [RFC4120] section 5.2.1.  Each entry should also indicate what
    the allocation is for and include a pointer to the relevant RFC or
    other specification.

  ... and adding normative references to RFC1964 and RFC2434.

-- Jeff