Subject: [secdir] Secdir review of draft-hansen-scram-sha256-02

From: Vincent Roca <[email-masked]>
Date: Wed, 13 May 2015 12:32:40 +0200

Hello,

I have reviewed this document as part of the security directorate’s ongoing
effort to review all IETF documents being processed by the IESG. These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.

Summary: ready with minor issues

This document records the SHA-256 variants of SCRAM SASL mechanisms.
As it complements RFC 5802, the authors refer to its security section:
   "The security considerations from [RFC5802] still apply."

I have no objection as RFC 5802 security section seems well documented
(I'm not an expert of the domain however).

That being said, I have two comments:

- there is no mention of the motivation for moving from SHA-1 to SHA-256.
  I think the security section is a nice place for that, and the authors can easily
  refer to RFC 4270 and RFC 6194 (there may be other references too that
  I’m not aware of).

- RFC 2119 is missing from the Normative References. Please add it.
   [R2119]  Bradner, S., "Key words for use in RFCs to Indicate
            Requirement Levels", BCP 14, RFC 2119, March 1997.
  I also think that RFC 4422 should be moved to the Normative References
  as it is a mandatory to read reference for the present document.

Cheers,

  Vincent

---

From: Dacheng <[email-masked]>
Date: Tue, 19 May 2015 10:15:26 +0800

Hello,

I have reviewed this document as part of the security directorate’s ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

This document is informational and proposes a framework for the management of the LISP EID Prefix.

I didn’t find any additional security related issues of this work. I think it is ready for publication.

Cheers

Dacheng

---

From: Tony Hansen <[email-masked]>
Date: Fri, 22 May 2015 19:59:50 -0400

On 5/13/15 6:32 AM, Vincent Roca wrote:
> *Summary: ready with minor issues
> *
>
>

Vincent, thank you for your review.

I've added the RFC2119 reference and moved 4422 to Normative.

I've added a reference to RFCs 4270 and 6194 in the security section.

    Tony