Subject: [Ietf-krb-wg] WGLC comments on draft-ietf-krb-wg-gss-cb-hash-agility-03.txt

From: Jeffrey Hutzelman <[email-masked]>
Date: Sun, 25 Nov 2007 01:11:01 -0500 (EST)

These are WG comments for draft-ietf-krb-wg-gss-cb-hash-agility-03.txt.
I've re-reviewed this document for WGLC, and found that all of the
comments I originally raised on the -00 version have been addressed.
Overall, this document looks to be in good shape.  I have only three new
comments, but I think we need to address all of them before the document
will be ready to move forward.

[JTH.1] (Abstract)  Since this document updates RFC4121, the abstract needs
to say so.

[JTH.2] (Section 3)  This section makes reference to a key usage number
"TBD".  If the goal is to avoid collisions with existing uses in Kerberos,
the GSS-API mechanism, and related protocols, then this requires us to
assign a number which does not conflict with those listed in section 7.5.1
or RFC4120.  Currently, Tom Yu is the keeper of that database.

[JTH.3] (Section 5)  This section establishes a new registry for Kerberos V
GSS-API mechanism extension types, which is a 32-bit space.  It specifies
the registration policy for these numbers as "IESG Protocol Action", but
neither details what that means nor makes reference to a source which does
so.  The namespace should be divided into one or more parts, with the
registration policy for each being set down clearly either via explicit
description or a reference to one of the policies described in RFC2434.

These policies need to be the result of a WG discussion on this issue.
To that end...

<hat role="WG chair" status="off">

Personally, I think applying a registration policy like "IESG Approval" to
the entire namespace is far too restrictive.  Given the size of the
namespace, it is probably appropriate to set aside a small portion for
Private Use, possibly reserve some part to be assigned by IESG Approval or
perhaps IETF Consensus, and use Specification Required or First Come First
Served for the rest.  It's unlikely that we're going to exhaust this
namespace.

</hat>

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg