Subject: [secdir] secdir review of draft-ietf-kitten-rfc6112bis-02

From: Carl Wallace <[email-masked]>
Date: Mon, 07 Nov 2016 18:16:46 -0500

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments
just like any other last call comments.

draft-ietf-kitten-rfc6112bis-02 is an update that obsoletes RFC 6112. It's
a copy of 6112 with a few corrections, some word-smithing and a small
amount of new text. A few minor comments are below:

- RFC6112 should appear in the bibliography.

- I'd add a few more items to section 1.1 (changes since 6112) to call out
the corrections to type names from RFC4556 and highlight the
KeyExchange->KEYEXCHANGE change. Rationale for the MUST->SHOULD change
might be nice here too.

- The IANA considerations section was right in 6112, but probably doesn't
belong here (at not least as defining a 'new' well-known name).

---

From: Shawn M Emery <[email-masked]>
Date: Tue, 8 Nov 2016 18:37:53 -0700

> - RFC6112 should appear in the bibliography.

Done.

> KeyExchange->KEYEXCHANGE change. Rationale for the MUST->SHOULD change

I've updated the section according to your suggestions:

--
In Section 7, the pepper2 string, "KeyExchange", is corrected to comply 
with the string actually used by implementations.

The requirement for the anonymous option to be used when an anonymous 
ticket is used in a TGS request is reduced from a MUST to a SHOULD.  At 
least one implementation does not require this and is not necessary that 
both be used as an indicator of request type.

Corrected the authorization data type name, AD-INITIAL-VERIFIED-CAS, 
referenced in this document.
--

Does this clarify the changes?

> belong here (at not least as defining a 'new' well-known name).

I've taken out the words 'new' from this section.

Thanks for your review and I've made the recommended updates in the next 
version of the draft.

Shawn.
--

---

From: Carl Wallace <[email-masked]>
Date: Wed, 09 Nov 2016 10:29:50 -0500

>Does this clarify the changes?

Yep. Thanks.