Subject: [secdir] Security review of draft-ietf-uta-xmpp-05

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 09 Apr 2015 05:04:49 +0200

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

This document is ready for publication.

I have only one small comment: draft-ietf-uta-xmpp does not really
recommend anything that has not already been recommended in the other
referenced specifications. Hence it appears a bit redundant.

---

From: Peter Saint-Andre - &yet <[email-masked]>
Date: Thu, 09 Apr 2015 18:28:12 -0600

> referenced specifications. Hence it appears a bit redundant.

Hallo Hannes,

One thing that is missing from the current version is an explicit update 
to RFC 6120 to make it clear that the best current practices recommended 
in draft-ietf-uta-tls-bcp apply to XMPP. Roni Even also pointed this out 
in his Gen-ART review. I suggested some text to remedy that oversight here:

http://www.ietf.org/mail-archive/web/uta/current/msg01108.html

Tschüss,

Peter

-- 
Peter Saint-Andre
https://andyet.com/