Subject: [Insipid] Suresh Krishnan's Discuss on draft-ietf-insipid-session-id-26: (with DISCUSS and COMMENT)

From: "Suresh Krishnan" <[email-masked]>
Date: Tue, 16 Aug 2016 16:30:53 -0700

Suresh Krishnan has entered the following ballot position for
draft-ietf-insipid-session-id-26: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-insipid-session-id/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

* Section 5

I do have a concern about backward compatibility regarding the sess-uuid.
Looks like this document allows the sess-uuid to contain either uppercase
or lowercase hex digits ("sess-uuid           = 32(DIGIT / %x41-46 /
%x61-66)") while the legacy version in RFC7329 does not allow uppercase
hex digits. Looks like a compliant implementation of the spec using upper
case hex digits will fail to interoperate with a legacy implementation. I
do not have a particular preference, but either this rule needs to be
tightened or there needs to be some text added to Section 11 to say this
will cause an interoperability issue.

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

* Section 4.1

The namespace ID in section 4.1 is specified as the initialization of a C
structure as described in Appendix C of RFC4122. It is missing a
semicolon at the end to make it legal.

OLD:
       uuid_t NameSpace_SessionID = {
           /* a58587da-c93d-11e2-ae90-f4ea67801e29 */
           0xa58587da,
           0xc93d,
           0x11e2,
           0xae, 0x90, 0xf4, 0xea, 0x67, 0x80, 0x1e, 0x29
       }

NEW:
       uuid_t NameSpace_SessionID = {
           /* a58587da-c93d-11e2-ae90-f4ea67801e29 */
           0xa58587da,
           0xc93d,
           0x11e2,
           0xae, 0x90, 0xf4, 0xea, 0x67, 0x80, 0x1e, 0x29
       };

* Agree with Alissa's DISCUSS regarding persistence

---

From: "Paul Giralt (pgiralt)" <[email-masked]>
Date: Wed, 17 Aug 2016 02:26:14 +0000

Suresh, thanks for the comments. Please see inline…

> On Aug 16, 2016, at 7:30 PM, Suresh Krishnan <[email-masked]> wrote:
> 

This was a last-minute change made as a result of comments from Elwyn in gen-art review. The concern was that RFC 7329 specifies the identifier is lowercase, however it then points out:

   NOTE: The sess-id value is technically case-INSENSITIVE, but only
   lowercase characters are allowed.

This means that a complaint implementation of 7329 should treat the characters as case-INSENSITIVE and therefore not have a problem.

We could back out the change and require lower-case to ensure this is not an issue. It just seemed strange that we are requiring lower case while simultaneously saying that the case doesn’t actually matter, hence the change.

Thank you. Will fix this.

> * Agree with Alissa's DISCUSS regarding persistence

Please see my notes in response to Alissa and let me know your thoughts.

-Paul

---

From: Suresh Krishnan <[email-masked]>
Date: Wed, 17 Aug 2016 18:37:53 +0000

Hi Paul,

> We could back out the change and require lower-case to ensure this is not an issue. It just seemed strange that we are requiring lower case while simultaneously saying that the case doesn’t actuall…

I think it would be better to back out the change and leave only the lower 
case in. No need to add any text about it being case-insensitive. This will 
allow the new implementations to be purely lowercase and be interoperable 
with the legacy implementations.

> Thank you. Will fix this.

Sounds good.

> Please see my notes in response to Alissa and let me know your thoughts.

The final resolutions you agreed on with Alissa sound fine to me.

Thanks
Suresh

---

From: "Paul Giralt (pgiralt)" <[email-masked]>
Date: Thu, 18 Aug 2016 15:03:22 +0000

> On Aug 17, 2016, at 2:37 PM, Suresh Krishnan <[email-masked]> wrote:
> 

After thinking about this a bit more, I agree with this. I will switch back to lowercase only but without the case sensitivity text. As the previous draft only allows sending lower case, we should be fine.