Subject: WG Last Call on draft-ietf-sasl-rfc2222bis-02

From: Alexey Melnikov <[email-masked]>
Date: Wed, 08 Oct 2003 14:58:59 +0100

I have an impression that there are two many little things to change so 
that we will need a new Last Call anyway.
Is my perception correct?

If it is, I will issue a new revision shortly.

Below is the list of open issues I still have to deal with (read this: I 
am planning to either update the document or send my comments):
1). IANA considerations and registering a familily of SASL mechanisms.
2). Clarification on replacing a security layer
3). Realm
4). Other minor editorial issues.

Alexey

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 09 Oct 2003 02:01:48 -0700

At 06:58 AM 10/8/2003, Alexey Melnikov wrote:
>I have an impression that there are two many little things to change so that we will need a new Last Call anyway.

Yes.  Given the large number of issues, I prefer to give you
as fairly wide latitude to make the changes you believe are
appropriate.  Once a new I-D is ready, we'll then ask the
WG to review the I-D to see consensus supports the changes
made and the document as a whole.

>If it is, I will issue a new revision shortly.

Great!

>Below is the list of open issues I still have to deal with (read this: I am planning to either update the document or send my comments):

You might look at BCP 64 (RFC 3383) guidelines for OID
descriptors and families of OID descriptors as an example.

>2). Clarification on replacing a security layer

I would like to hear folks comments on the appropriateness of
uninstalling layers after a failed subsequent exchange.

>3). Realm

I have not yet heard any arguments to keep the realm text.

Kurt

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 09 Oct 2003 10:50:53 +0100

>uninstalling layers after a failed subsequent exchange.
This is not the issue. What you are talking about violates SASL spec.

The issues is whether to keep the old security layer or remove it
a). in protocols that allow for reauthentication (e.g. LDAP and HTTP)
b). after a second or subsequent successful reauthentication.

Alexey

---

From: Hallvard B Furuseth <[email-masked]>
Date: Tue, 14 Oct 2003 17:33:05 +0200

> I have not yet heard any arguments to keep the realm text.

I found it useful, since I had no clear idea what a realm was.
The text is just too demanding.  How about making the text purely
informational, without any SHOULD or MUST?

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 14 Oct 2003 09:44:46 -0700

>informational, without any SHOULD or MUST?

I think the primary concern is that the text introduces a
concept with is particular to one or more mechanisms and
hence is out of place.   Seems better to move the text
into the DIGEST-MD5 specification as it seems to following
the DIGEST-MD5 concept of a realm.  Other mechanisms also
have realm concepts, but it's not clear to me that they
are the same as DIGEST-MD5's.

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 09 Oct 2003 02:01:48 -0700

Great!

Kurt

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 09 Oct 2003 10:50:53 +0100

Alexey

---

From: Hallvard B Furuseth <[email-masked]>
Date: Tue, 14 Oct 2003 17:33:05 +0200

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 14 Oct 2003 09:44:46 -0700

Kurt