Subject: Re: [Ietf-krb-wg] Gen-ART review of draft-ietf-krb-wg-otp-preauth-18

From: <[email-masked]>
Date: Tue, 6 Sep 2011 15:08:52 -0400

I have completed the changes to the OTP pre-auth draft that came about from the WG discussion on nonce usage and the AD and Gen ART reviews.  The rfcdiff output is attached.

--Gareth

A) WG discussion on nonce usage

1. Section 3.2 - KDC Challenge
Changed text in paragraph 3 regarding nonce in PA-OTP-CHALLENGE

2 Section 4.1 - PA-OTP-CHALLENGE

B) Stephen's AD review comments

1. Section 1.1
Expanded the acronym FAST

2. Section 1.2
Removed text regarding 4-pass mode only being usable in cases requiring pre-authentication.

3. Section 3.6 - Reply Key Generation
Removed the use of "||" as well as "|" for concatenation.

4. Section 3.3 - Client Response
Added requirement for otp-service and otp-vendor matching to be case-sensitive.

5. Appendix A - ASN.1 Module
Fixed comment in ASN.1 module to import from RFC5280 and added normative reference.

C) David Black's Gen Art review comments

1. Section 6.1 - Security Considerations Clarified text regarding the use of anonymous PKINIT with algorithms requiring OTP values to be sent to the KDC.

2. Section - IANA considerations
Clarified the text in sections 4.1, 4.2 and 5 so that the otp-algID MUST be a URI and SHOULD be from the PSKC registry of RFC6030.

3. Section 2.4 - Re-Synchronization
Added a paragraph to expand on how the re-synchronization mechanism described in the document can be used.

> -----Original Message-----
> From: Sam Hartman [mailto:[email-masked]]
> Sent: 06 September 2011 04:24
> To: Richards, Gareth
> Cc: [email-masked]; [email-masked]
> Subject: Re: Gen-ART review of draft-ietf-krb-wg-otp-preauth-18
>
> Hi.  I'd appreciate it if you could prepare a new version including
> all the proposed fixes. I'd prefer you stick with shoulds for the OTP
> alg IDs, although you should probably include a MUSt be a URI.
>
> I'd appreciate it if you would send an rfcdiff to the list and to
> Stephen rather than actually uploading. If Stephen acks and no one on
> the WG objects then he can take to the IESG.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg