Subject: [secdir] SECDIR review of draft-shin-augmented-pake-10

From: Tina TSOU <[email-masked]>
Date: Thu, 26 Jan 2012 22:39:32 +0000

Hi,
I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

I found some editorial glitches and the use of "temporal" when "temporary" was intended, but someone else can catch those.

Reference K11 is now RFC 6467. That means the Notify message type and the GSPM payload type have now been assigned (16424 and 49 respectively) and can be inserted into the document where it currently says "TBD".

The request to IANA names the wrong registry. The correct name is "IKEv2 Secure Password Methods" registry, established by RFC 6467.

The relationship between this document and RFC 6467 is odd. In the ordinary course of events this document would have a normative dependency on RFC 6467. It is obvious that the latter was written after the present document, and avoidance of the dependency was deliberate on both sides. Still, the authors of this document might reconsider, even though RFC 6467 would be a down-reference since it is Informational.

Tina

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 27 Jan 2012 15:50:41 +0200

Tina TSOU writes:
> The relationship between this document and RFC 6467 is odd. In the
> ordinary course of events this document would have a normative
> dependency on RFC 6467.

Not exactly. The original intention is that all documents using
numbers defined in my draft (now RFC6467) would be self-containing,
and there might not even be need for publishing my draft as RFC, it
was originally just written as tool so that all secure password method
drafts could coordinate their numbers. As it is now published as RFC,
I think it is ok to make either normative or non-normative reference
to it, depending whether the document itself is self-containing or
not.

Currently I think all the secure password method documents are
self-containing, thus non-normative reference is needed, the
implementor who is implementing the secure password method in
question, does not NEED to read RFC6467 to be able to implement for
example draft-shin-augmented-pake as that draft already contains all
information needed. 

> It is obvious that the latter was written
> after the present document, and avoidance of the dependency was
> deliberate on both sides. Still, the authors of this document might
> reconsider, even though RFC 6467 would be a down-reference since it
> is Informational. 

The intended status of draft-shin-augmented-pake is listed as
experimental, so there really a down-reference problem there?

Anyways as draft-shin-augmented-pake self-contained, the reference can
be non-normative.
-- 
[email-masked]