Subject: [Last-Call] Last Call: <draft-ietf-tls-external-psk-guidance-03.txt> (Guidance for External PSK Usage in TLS) to Informational RFC

From: "Quick, Matthew" <[email-masked]>
Date: Tue, 9 Nov 2021 14:13:37 +0000

Hello IESG, 

I hope this finds you well. Please find comments for “draft-ietf-tls-external-psk-guidance-03”, below. The document is well written and the latest revision has improved the clarity of presentation – no concerns with publication, only minor editorial comments. Your feedback is greatly appreciated. 

Best,

Matthew Quick, Verisign

____________________________

 2. Section 7, items 1 and 2

Justification:

Both use the acronym "EPSK" without defining it.

Existing text:

"EPSK"

Suggested text:

"external PSK" in both places, consistent with other uses throughout the document.

____________________________

3. Section 7, item 2:

Justification:

Editorial correction.

Existing text:

"PSKs know to a group".

Suggested text:

"PSKs known to a group".

____________________________

4. Section 4.1

Justification:

Items 2 and 3 respectively describe an attacker who can "read (and modify)" and "passively read (and actively modify)" traffic.  Unless "read" is meant to be different than "passively read," and "modify" differs from "actively modify,".

Suggested text:

Either dropping  "actively" and "passively" from item 3, or moving the terms to item 2 so they qualify "modify" and "read" on first use and thus extend to both uses.

____________________________

5. Section 8, paragraph 2

Justification:

Editorial correction.

Existing text:

"and uses it"

Suggested text:

"and use it" (matching change from "selects" to "to select")

Best,

Matt

Matthew Quick

Senior Engineer

Industry Standards & Technical Engagement

[email-masked]

571.732.6173

12061 Bluemont Way, Reston, VA 20190