Subject: [http-auth] Benoit Claise's No Record on draft-ietf-httpauth-mutual-algo-06: (with COMMENT)

From: "Benoit Claise" <[email-masked]>
Date: Tue, 01 Nov 2016 14:57:17 -0700

Benoit Claise has entered the following ballot position for
draft-ietf-httpauth-mutual-algo-06: No Record

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-httpauth-mutual-algo/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Some editorial comments from our OPS-DIR reviewer, Qin Wu.

This document defines four HTTP Mutual authentication algorithms which
use with Mutual authentication protocol for HTTP, two for Discrete
Logarithm settings, two for elliptic curve settings. In addition, the
security of this algorithm is well analyzed.

There is no major issue. I believe this document is ready for
publication. Here are a few editorial comments I like to ask authors to
consider:

Minor issues:

1.       Section 1.1 said:

“

When a natural

   number output is required, the notation INT(H(s)) is used.

”

I will see INT(H(s)) as a formula to convert H(s) into natural number

2.       Section 2, 1st paragraph:

What is DL-based notations? Can you expand DL? Is it Description Logic or
something else?

You can consider to add acronym and abbreviation section.

3.Section 2, 2nd paragraph and the figure that describe protocol exchange
for four value

Where you define the first two messages in this draft? Are you referred
to the first messages that contain ID, K_c1 and K_s1 respectively in the
figure? I don’t see you specify message format or give a message name? I
don’t see you related text with the message shown in the figure?

In addition, where the last two message defined in
[I-D.ietf-httpauth-mutual]? Can you provide section number?

By reading [[I-D.ietf-httpauth-mutual], I see K_c1, K_s1, VK_c,VK_s has
already been defined in [[I-D.ietf-httpauth-mutual], I feel confused and
am wondering if this draft really defines the first two messages? Or four
message shown in the figure are all defined in the
[[I-D.ietf-httpauth-mutual].

4.Section 3.1, 3rd paragraph said:

“

The functions named octet(), OCTETS(), and INT() are those defined in

the core specification [I-D.ietf-httpauth-mutual].

“

Is the core specification [I-D.ietf-httpauth-mutual]the core document
mentioned in section 3? If yes, please make them consistent.

5.Section 3.3, symbol “G”

g: for "the generator" associated with the group.

How the symobol “G” is different from symbol “g”in the section 3.2? Does
G stand for the generator associated with the defined group? What do you
mean “the defined point”? Would be great to clarify the difference
between G and g.

6.Section 5.2 said:

“

In the EC setting, r has to be

prime.  Defining a variation of this algorithm using a different

domain parameter SHOULD be attentive to these conditions.

“

What is EC setting? Please expand EC? Elliptic Curve? Please make this
clear or add this abbreviation into abbreviation section.

Nites:

1.Section 1,1st paragraph

s/ use withMutual authentication protocol/ use with Mutual authentication
protocol

2.Section 5.2

s/ mixing values from from two/ mixing values from two

-Qin

---

From: Yutaka OIWA <[email-masked]>
Date: Wed, 9 Nov 2016 16:27:35 +0900

Dear Benoit,

thank you for forwarding the comments from Qin Wu.
We reflect these comments to the next draft.

-- 
大岩 寛   Yutaka OIWA             (国研)産業技術総合研究所 情報技術研究部門
                                     サイバーフィジカルウェア研究グループ長
                                      <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]