Subject: Last Call: draft-ietf-openpgp-rfc2440bis (OpenPGP Message Format) to Proposed Standard

From: The IESG <[email-masked]>
Date: Tue, 13 Mar 2007 09:43:15 -0400

The IESG has received a request from the An Open Specification for 
Pretty Good Privacy WG (openpgp) to consider the following document:

- 'OpenPGP Message Format '
   <draft-ietf-openpgp-rfc2440bis-19.txt> as a Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action.  Please send substantive comments to the
[email-masked] mailing lists by 2007-03-27. Exceptionally, 
comments may be sent to [email-masked] instead. In either case, please 
retain the beginning of the Subject line to allow automated sorting.

The file can be obtained via
http://www.ietf.org/internet-drafts/draft-ietf-openpgp-rfc2440bis-19.txt

IESG discussion can be tracked via
https://datatracker.ietf.org/public/pidtracker.cgi?command=view_id&dTag=4936&rfc_flag=0

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 13 Mar 2007 15:26:42 +0100

Hi!

I started a review by going through the reference section.  There
seems to be some editing left to do...

There are reference to old documents, including:

  RFC 2279 -> RFC 3629
  RFC 1750 -> RFC 4086

There are normative reference to non-standards track RFCs, including:

  RFC 1641
  RFC 1951
  RFC 1991 (which documents is intended to obsolete?)
  RFC 2144

The following reference are never cited in the text as far as I can
tell.  Most of them should likely be removed, but citing
[BLEICHENBACHER] at some appropriate point may be useful.

    [RFC1423]        Balenson, D., "Privacy Enhancement for Internet
                     Electronic Mail: Part III: Algorithms, Modes, and
                     Identifiers", RFC 1423, October 1993.

    [RFC1641]        Goldsmith, D. and M. Davis, "Using Unicode with
                     MIME", RFC 1641, July 1994.

    [BLEICHENBACHER] Bleichenbacher, Daniel, "Generating Elgamal
                     signatures without knowing the secret key,"
                     Eurocrypt 96. Note that the version in the
                     proceedings has an error. A revised version is
                     available at the time of writing from
                     <ftp://ftp.inf.ethz.ch/pub/publications/papers/ti
                     /isc/ElGamal.ps>

    [DONNERHACKE]    Donnerhacke, L., et. al, "PGP263in - an improved
                     international version of PGP", ftp://ftp.iks-
                     jena.de/mitarb/lutz/crypt/software/pgp/

    [MAURER]         Ueli Maurer, "Modelling a Public-Key
                     Infrastructure", Proc. 1996 European Symposium on
                     Research in Computer Security (ESORICS' 96),
                     Lecture Notes in Computer Science, Springer-Verlag,
                     vol. 1146, pp. 325-350, Sep 1996.

    [RFC1983]        Malkin, G., "Internet Users' Glossary", FYI 18, RFC
                     1983, August 1996.

/Simon