Subject: [secdir] SecDir review of draft-ietf-eai-imap-utf8-07

From: Paul Hoffman <[email-masked]>
Date: Fri, 28 Aug 2009 09:14:31 -0700

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

The security sections of this document are fine. The Security Considerations section says, in full:
   The security considerations of UTF-8 [RFC3629] and SASLprep [RFC4013]
   apply to this specification, particularly with respect to use of
   UTF-8 in user names and passwords.  Otherwise, this is not believed
   to alter the security considerations of IMAP4rev1.
That should actually sufficient for implementers of this document. The new uses of UTF-8 described here should not cause an additional security problems beyond what IMAP implementers already face.

The language used in the document is probably appropriate for an IMAP developer who has read lots of other IMAP extensions, but is quite rough for people reading this from an i18n or EAI perspective.

The document *is not ready* for IESG review, however. In fact, it should not have been placed in IETF Last Call in its current state. Did anyone even read the Abstract, for crying out loud? Further, the I-D Nits checker finds two hard errors: a line the is obviously too long, and an obsolete normative reference.

Even though this document hasn't garnered any other IETF Last Call comments, it really needs a careful review from the authors and the document shepherd. (The I-D tracker does not say who the document shepherd is, so I have Cc'd the two WG chairs on this note, assuming one of the two of them was the shepherd but that did not get reported to the tracker.)

--Paul Hoffman, Director
--VPN Consortium

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 28 Aug 2009 19:51:06 +0100

Hi Paul,
Thanks for the review.

Paul Hoffman wrote:

>The document *is not ready* for IESG review, however. In fact, it should not have been placed in IETF Last Call in its current state.
>
Arguably this is my fault, I was eager to get this document to IESG 
review due to external deadlines on EAI work.

>Did anyone even read the Abstract, for crying out loud?
>
Well, Ok, I haven't read it recently. And nobody in the WG has spotted this:

   This is an early draft and intended as a framework for discussion.  Please
   do not deploy implementations of this draft.

which I will ask to remove.

>Further, the I-D Nits checker finds two hard errors: a line the is obviously too long, and an obsolete normative reference.
>
While I agree that these should have been fixed, I personally don't 
think it is a big deal. In particular outdated references are regularly 
fixed by RFC Editor and frequently spotted during IESG review.
(As a side note: on the last IESG telechat I saw a reference to a 
document that was obsoleted 3 times. This was quite impressive :-)).

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 28 Aug 2009 20:04:40 +0100

Alexey Melnikov wrote:

>> Further, the I-D Nits checker finds two hard errors: a line the is 
>> obviously too long, and an obsolete normative reference.
>
Actually, I think the latter was intentional, but I need to double check.

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 28 Aug 2009 13:57:32 -0700

At 7:51 PM +0100 8/28/09, Alexey Melnikov wrote:
>While I agree that these should have been fixed, I personally don't think it is a big deal.

Nor do I, that's why I didn't send this to the IESG or the IETF general list. However, Tim and Pasi have asked SecDir reviewers to comment on all aspects of a draft we are reviewing, not just the security aspects. I did not, for example, comment on the grammar issues that I strongly suspect will be fixed by the RFC Editor. However, if I were an IESG member reading the document for the first time, I would immediately ask why the abstract says "do not deploy implementations of this draft" for something that is meant to be an Experimental RFC.

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 28 Aug 2009 21:58:58 +0100

>Nor do I, that's why I didn't send this to the IESG or the IETF general list. However, Tim and Pasi have asked SecDir reviewers to comment on all aspects of a draft we are reviewing, not just the se…
Fair enough.