Subject: Re: WG LAST CALL: draft-ietf-smime-rfc2633bis-07.txt

From: "Sean P. Turner" <[email-masked]>
Date: Tue, 02 Mar 2004 11:44:50 -0500

Only minor editorial comments (read NO show stoppers):

Para 1.3, Certificate definition: Replace "distinguished name"
with "name" the names are not always "distinguished."

Para 1.3, Receiving agent, Sending agent, and S/MIME agent
definitions: Capitalize 1st word "software" and "user."

Para 2.2, Last paragraph last sentence: replace "and may not
implement id-dsa-with-sha1 at all" with "and may not implement
id-dsa-with-sha1 or id-sha at all."

Para 2.4.2, SignedData Content Type: Can we add a sentence that
says "Applying a signature to message provides authentication, message
integrity, and non-repudiation of origin."  The other content types
indicate what "services" they support or don't support.

Para 2.4.4, 2nd sentence: Replace "This content type does not
provide authentication or privacy" with "This content type does not
provide authentication, message integrity, non-repudiation, or data
confidentiality".  Just making it match the "services" listed in the
introduction.

Para 3.1, Steps 1-4: Add periods to end of sentences.

Para 3.1.3, 3rd Para 2nd sentence: Replace "8-bit clear" with
"8-bit clean" to match terminology in 3.1.2 2nd paragraph 4 sentence.

Para 3.3, Step 2, last sentence: Replace "(see CMS Section 6)"
with (see [CMS] Section 6).

Para 3.4.2, Steps 1&2: Add periods to end of sentences.

Compressed data text in 3.5 points to 3.1 but there's no mention
in 3.1 of compression.  You should either add a sentence to say that in
3.1 enveloped = compression in this section or make the following
changes (or others to clarify that you also mean to refer to
compression data):

Para 3.1, Title: Replace "Signing or Enveloping" with "Signing,
Enveloping, or Compressing" because para 3.5 says perform message as in
3.1 but there's not mention of compressing in 3.1.

Para 3.1, 1st para 1st sentence: Replace "S/MIME is used to
secure MIME entities" with "S/MIME is used to secure and optionally
compress MIME entities."

Para 3.1, 2nd para 1st sentence: Replace "The MIME entity that
is secured and ..." with "The MIME entity that is secured or compressed
and ..."

Para 3.1, 4th para 1st sentence: Replace "A single procedure is
used for creating MIME entities that are to be
signed, enveloped, or both signed and enveloped" with "A single
procedure is used for creating MIME entities that are to be
signed, enveloped, compressed and both signed and enveloped, signed and
compressed, compressed and enveloped, and compressed, signed, and
enveloped, etc." (or whatever # of combinations you feel like listing)

Para 3.1, 4th para 3rd sentence: Replace "It is recommended
that
these additional steps be performed on enveloped messages, or signed
and enveloped messages" with "It is recommended that
these additional steps be performed on enveloped and compressed
messages, or signed
and enveloped messages or compressed, signed and enveloped messages."

Para 3.1, 1st para after Step 3: Replace "the security services
on the
message are processed" with "the security services or compression on
the
message are processed"

Para 3.5, Step 1: Replace "to be enveloped" with "to be
compressed".

Para 3.7, Step 3: Add period to end of sentence.

Annex F, Remove prior to submission to IESG (?)

---

From: "Blake Ramsdell" <[email-masked]>
Date: Thu, 25 Mar 2004 20:44:37 -0800

Comments inline. Good luck finding them.

-----Original Message-----
From: Sean P. Turner [mailto:[email-masked]] 
Sent: Tuesday, March 02, 2004 8:45 AM
To: Blake Ramsdell
Cc: [email-masked]
Subject: Re: WG LAST CALL: draft-ietf-smime-rfc2633bis-07.txt

Para 1.3, Certificate definition: Replace "distinguished name" with
"name" the names are not always "distinguished."

[bcr] Neat. That's not even correct either. It binds a bunch of
arbitrary things (including a picture of your cat) to a public key.
Switched to "name".

Para 1.3, Receiving agent, Sending agent, and S/MIME agent definitions:
Capitalize 1st word "software" and "user." 

[bcr] Done.

Para 2.2, Last paragraph last sentence: replace "and may not implement
id-dsa-with-sha1 at all" with "and may not implement id-dsa-with-sha1 or
id-sha at all." 

[bcr] I presume you meant "id-dsa" not "id-sha" here. Done.

Para 2.4.2, SignedData Content Type: Can we add a sentence that says
"Applying a signature to message provides authentication, message
integrity, and non-repudiation of origin."  The other content types
indicate what "services" they support or don't support.

[bcr] Done.

Para 2.4.4, 2nd sentence: Replace "This content type does not provide
authentication or privacy" with "This content type does not provide
authentication, message integrity, non-repudiation, or data
confidentiality".  Just making it match the "services" listed in the
introduction.

[bcr] Done.

[bcr] Done.

Para 3.1.3, 3rd Para 2nd sentence: Replace "8-bit clear" with "8-bit
clean" to match terminology in 3.1.2 2nd paragraph 4 sentence.

[bcr] Done.

Para 3.3, Step 2, last sentence: Replace "(see CMS Section 6)" with (see
[CMS] Section 6). 

[bcr] Done.

[bcr] Done.

Compressed data text in 3.5 points to 3.1 but there's no mention in 3.1
of compression.  You should either add a sentence to say that in 3.1
enveloped = compression in this section or make the following changes
(or others to clarify that you also mean to refer to compression data): 
Para 3.1, Title: Replace "Signing or Enveloping" with "Signing,
Enveloping, or Compressing" because para 3.5 says perform message as in
3.1 but there's not mention of compressing in 3.1. 

[bcr] Done.

Para 3.1, 1st para 1st sentence: Replace "S/MIME is used to secure MIME
entities" with "S/MIME is used to secure and optionally compress MIME
entities."

[bcr] Done.

Para 3.1, 2nd para 1st sentence: Replace "The MIME entity that is
secured and ..." with "The MIME entity that is secured or compressed and
..." 

[bcr] Nope. We're going with "secured" here until someone comes up with
a concise word that means "signed or encrypted or compressed".

Para 3.1, 4th para 1st sentence: Replace "A single procedure is used for
creating MIME entities that are to be signed, enveloped, or both signed
and enveloped" with "A single procedure is used for creating MIME
entities that are to be signed, enveloped, compressed and both signed
and enveloped, signed and compressed, compressed and enveloped, and
compressed, signed, and enveloped, etc." (or whatever # of combinations
you feel like listing)

[bcr] A single procedure is used for creating MIME entities that are to
have any combination of signing, enveloping and compressing applied.

Para 3.1, 4th para 3rd sentence: Replace "It is recommended that these
additional steps be performed on enveloped messages, or signed and
enveloped messages" with "It is recommended that these additional steps
be performed on enveloped and compressed messages, or signed and
enveloped messages or compressed, signed and enveloped messages." 

[bcr] I'm not even sure what the spirit of this guidance is. No change
-- either suggest less awkward language or help me figure out what the
spirit of this is.

Para 3.1, 1st para after Step 3: Replace "the security services on the
message are processed" with "the security services or compression on the
message are processed" 

[bcr] See previous discussion about "secured"

Para 3.5, Step 1: Replace "to be enveloped" with "to be compressed". 

[bcr] Done.

[bcr] Done.

[bcr] No more changes from last draft.

---

From: "Sean P. Turner" <[email-masked]>
Date: Fri, 26 Mar 2004 10:59:03 -0500

Comments inline

...snip

>a concise word that means "signed or encrypted or compressed".
[spt] How about having "signed or encrypted or compressed (s/e/c)" in 
the 1st instance and then repeating "s/e/c" after that?

>have any combination of signing, enveloping and compressing applied.
[spt] Did you change it to say that?

>-- either suggest less awkward language or help me figure out what the
[spt] I was just trying to be complete and list all the times the steps 
should be taken.  Comment was in line with the above three.

>[bcr] See previous discussion about "secured"
[spt] As long as we do it the same way.

Cheer - spt