Re: WG Last Call: draft-ietf-sasl-scram-02

[Simon Josefsson <simon@xxxxxxxxxxxxx>]

Simon Josefsson <simon@xxxxxxxxxxxxx> writes:

> I'll get to reviewing the technical part of the document, promise! :)
>
> Running idnits on the document, it says
>
>   == The document seems to lack a disclaimer for pre-RFC5378 work, but was
>      first submitted before 10 November 2008.  Should you add the disclaimer?
>      (See the Legal Provisions document at
>      http://trustee.ietf.org/license-info for more information.). 
>
> The document has a long history, is the current legal boilerplate ok?

This was fixed in -02, sorry I ran an older document through idnits.

> However there are several documents added as references but not
> mentioned in the document itself:
>
>   == Unused Reference: 'I-D.ietf-sasl-rfc2831bis' is defined on line 1050,
>      but no explicit reference was found in the text
>
>   == Unused Reference: 'RFC2195' is defined on line 1055, but no explicit
>      reference was found in the text
>
>   == Unused Reference: 'RFC2202' is defined on line 1059, but no explicit
>      reference was found in the text

This comment still holds.  -02 also contain a dangling reference to
PKIX:

  == Unused Reference: 'RFC5280' is defined on line 1042, but no explicit
     reference was found in the text

>   == Unused Reference: 'RFC4086' is defined on line 1065, but no explicit
>      reference was found in the text
>
> The first three should probably be just removed (?).  But the last one
> seems useful to reference normatively.  How about adding the following
> to Security Considerations?
>
>   See [RFC4086] for more information about generating randomness.

This comment also still holds.

/Simon