Subject: [Ietf-krb-wg] AD review of draft-ietf-krb-wg-gss-cb-hash-agility

From: Stephen Farrell <[email-masked]>
Date: Fri, 12 Aug 2011 14:18:58 +0100

Nothing huge here but a few things to check/figure out.

I've put this into AD evaluation:revised ID needed for now since
I guess a new rev will be needed.

Cheers,
S.

issues:

1) the write-up says that the WG need to figure out where to put the
new IANA registry for extension types, have you figured that out
yet? (The write-up also asks for IETF LC to not start until that's
sorted out.)

2) Where's the key usage number 43 come from? (I do see 7.5.1 from
rfc 4120) Is there an IANA registry for these? (I didn't see it.) If
not, should there be? If so, should this document just create that
too? (And what's the update rule - FCFS?) If this is better not done
as an IANA registry (or not now) then I'd appreciate the explanation
in any case, even if that's not added to the document.  (But why not
add it?)

3) A test vector for one popular variation of get_mic would be very
good to add - with all the endian stuff I could see this being done
wrong quite easily but in a way that a single implementation would
not show up.

4) Is it ok for an initiator to send Bnd=0xFF...FF and not to send a
get_mic based channel binding in the Exts field? I guess it is, but
you don't say.

5) Just wondering: have the two implementations of this been tested
against one another?

minor stuff:

1) intro: add a reference to rfc 6151 for details as to why md5 is
no longer good

2) Should you also say what can happen at the various types of
acceptor, just to be extra clear? (That could be done by adding a
table maybe, not sure if that's worth it.)

3) id-nits has a couple of warnings - can you check if those
are ok and fix if not?

typos:

abstract: s/based on Kerberos/based on the Kerberos/

sec-cons: s/the application/applications/ (the next sentence uses
the plural "applications")

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Fri, 12 Aug 2011 11:59:33 -0400

I'd appreciate responses to the rest of the AD comments. Here are
responses I can make.

>>>>> "Stephen" == Stephen Farrell <[email-masked]> writes:

    Stephen> 1) the write-up says that the WG need to figure out where
    Stephen> to put the new IANA registry for extension types, have you
    Stephen> figured that out yet? (The write-up also asks for IETF LC
    Stephen> to not start until that's sorted out.)

No one objected to my proposed text.
Authors, can you incorporate  my proposed text creating the registry
into the next version?

    Stephen> 2) Where's the key usage number 43 come from? (I do see
    Stephen> 7.5.1 from rfc 4120) Is there an IANA registry for these?
    Stephen> (I didn't see it.) If not, should there be? If so, should
    Stephen> this document just create that too? (And what's the update
    Stephen> rule - FCFS?) If this is better not done as an IANA
    Stephen> registry (or not now) then I'd appreciate the explanation
    Stephen> in any case, even if that's not added to the document.
    Stephen> (But why not add it?)

This is not yet managed by IANA; draft-lha-krb-wg-some-numbers-to-iana
creates the registry.  Tom Yu is keeping track meanwhile. We discussed
the big outstanding issue with Love's draft at IETF 80; we expect to be
making progress shortly.

    Stephen> 3) A test vector for one popular variation of get_mic would
    Stephen> be very good to add - with all the endian stuff I could see
    Stephen> this being done wrong quite easily but in a way that a
    Stephen> single implementation would not show up.

Can someone volunteer to include this?
I agree that this would be really helpful.
    Stephen> 3) id-nits has a couple of warnings - can you check if
    Stephen> those are ok and fix if not?

I did check as part of doing the writeup.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 12 Aug 2011 17:11:46 +0100

Hi Sam,

> Authors, can you incorporate  my proposed text creating the registry

Great.

> the big outstanding issue with Love's draft at IETF 80; we expect to be

That's fine thanks.

> I agree that this would be really helpful.

Me too obviously:-)

> I did check as part of doing the writeup.

When I did it from this URL [1] I get the output below. Could be they're
spurious warnings I guess but I just wanted to check.

Cheers,
Stephen.

[1]
http://tools.ietf.org/idnits?url=http://tools.ietf.org/id/draft-ietf-krb-wg-gss-cb-hash-agility-07.txt

 Checking nits according to http://www.ietf.org/id-info/checklist :

----------------------------------------------------------------------------

  == There are 1 instance of lines with non-RFC5735-compliant IPv4
     addresses in the document.  If these are example addresses,
     they should be changed.

  Miscellaneous warnings:

----------------------------------------------------------------------------

  == The document seems to lack a disclaimer for pre-RFC5378 work, but
     was first submitted before 10 November 2008.  Should you add the
     disclaimer? (See the Legal Provisions document at
     http://trustee.ietf.org/license-info for more information.) --
     however, there's a paragraph with a matching beginning.
     Boilerplate error?

---

From: Sam Hartman <[email-masked]>
Date: Fri, 12 Aug 2011 13:20:31 -0400

>>>>> "Stephen" == Stephen Farrell <[email-masked]> writes:
You and I got the same output.

    Stephen> ----------------------------------------------------------------------------

    Stephen>   == There are 1 instance of lines with
    Stephen> non-RFC5735-compliant IPv4 addresses in the document.  If
    Stephen> these are example addresses, they should be changed.

They're OIDs.

    Stephen>   Miscellaneous warnings:

    Stephen> ----------------------------------------------------------------------------

    Stephen>   == The document seems to lack a disclaimer for
    Stephen> pre-RFC5378 work, but was first submitted before 10
    Stephen> November 2008.  Should you add the disclaimer? (See the
    Stephen> Legal Provisions document at
    Stephen> http://trustee.ietf.org/license-info for more information.)
    Stephen> -- however, there's a paragraph with a matching beginning.
    Stephen> Boilerplate error?

This means the author is choosing to give us the newer permissions.
Given that it's a single copyright holder who is still actively
involved, I'd kind of expect this.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 12 Aug 2011 18:35:55 +0100

Thanks Sam,
S.

---

From: Shawn Emery <[email-masked]>
Date: Mon, 15 Aug 2011 11:49:12 -0600

On 08/12/11 09:59 AM, Sam Hartman wrote:
>>>>>> "Stephen" == Stephen Farrell<[email-masked]>  writes:

It's been updated in my copy.

> I agree that this would be really helpful.

I will look into this...

> I did check as part of doing the writeup.

Per subsequent e-mails, these have been determined to be false-positives.

Shawn.
--