Subject: Re: WG chair nits on draft-ietf-secsh-auth-kbdinteract-04.txt

From: Frank Cusack <[email-masked]>
Date: Mon, 21 Apr 2003 03:41:14 -0700

On Tue, Mar 18, 2003 at 09:24:48AM -0800, Bill Sommerfeld wrote:
> 1) normative/informative reference split.
> 
> 	look like [PAM] is informative; everything else is normative.
> 
> 	[rfc-2279] is not explicitly referenced anywhere by reference
> 	id, but is normative (for encoding of various forms here and
> 	there).

ok

> 2) security considerations.

ok

> 3) iana considerations.
> 
> 	"protocol constants" should turn into "iana considerations".
> 
> 	also an explicit allocation of the userauth type
> 	"keyboard-interactive" needs to be listed.

ok

Here are proposed changes, covering the above and some other minor items.
I think they are pretty non-contentious.  I'm not sure if I addressed
the allocation of "keyboard-interactive" very well.

Comments, please.

 1. Introduction
 
-   The SSH authentication protocol is a general-purpose user
-   authentication protocol. It is intended to be run over the SSH
-   transport layer protocol [SSH-TRANS].  The protocol assumes that the
-   underlying protocols provide integrity and confidentiality
-   protection.
+   The SSH authentication protocol [SSH-USERAUTH] is a general-purpose
+   user authentication protocol. It is intended to be run over the SSH
+   transport layer protocol [SSH-TRANS].  The authentication protocol
+   assumes that the underlying protocols provide integrity and
+   confidentiality protection.
 
[The original text appears to have been lifted directly from SSH-USERAUTH
and so needed some updating for references.]

    This document describes a general purpose authentication method for
-   the SSH protocol.  This method is suitable for interactive
+   the SSH authentication protocol.  This method is suitable for
+   interactive ...
 
-   somewhat out of the scope of a protocol specification, it is still
-   described here since some aspects of the protocol are specifically
+   somewhat out of the scope of a protocol specification, it is
+   described here anyway since some aspects of the protocol are

[it is still described here -> it is described here anyway]
 
    The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
    "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
-   document are to be interpreted as described in RFC 2119.
+   document are to be interpreted as described in [RFC-2119].

 3.1 Initial Exchange
 ...
       byte      SSH_MSG_USERAUTH_REQUEST
-      string    user name (ISO-10646 UTF-8)
+      string    user name (ISO-10646 UTF-8, as defined in [RFC-2279])

[I left other mentions of UTF-8 without endnote refs, that's ok, yeah?]

 4. Authentication Examples
 
    Here are two example exchanges between a client and server.  The
-   first is an example of a challenge/response implementation.  This is
-   an authentication that is not otherwise possible with other
+   first is an example of challenge/response with a handheld token.
+   This is an authentication that is not otherwise possible with other
    authentication methods.

-5. Protocol constants
+5. IANA Considerations
+
+   The userauth type "keyboard-interactive" is used for this
+   authentication method.
 
    The following method-specific constants are used with this
    authentication method:

-6. References
+6. Security Considerations
 
+   The authentication protocol, and this authentication method, depends
+   on the security of the underlying SSH transport layer.  Without the
+   confidentiality provided therein, any authentication data passed with
+   this method is subject to interception.
+
+   The number of client-server exchanges required to complete an
+   authentication using this method may be variable.  It is possible
+   that an observer may gain valuable information simply by counting
+   that number.  For example, an observer may guess that a user's
+   password has expired, and with further observation may be able to
+   determine the frequency of a site's password expiration policy.
 
+7. References
 
+7.1 Normative References
 
+7.2 Informative References

+   [PAM]           Samar, V., Schemers, R., "Unified Login With
+                   Pluggable Authentication Modules (PAM)", OSF RFC
+                   86.0, October 1995
 
That's it.  I've also attached a complete copy.

/fc