Subject: [Emu] Pete Resnick's No Objection on draft-ietf-emu-eap-tunnel-method-07: (with COMMENT)

From: "Pete Resnick" <[email-masked]>
Date: Thu, 15 Aug 2013 06:57:22 -0700

Pete Resnick has entered the following ballot position for
draft-ietf-emu-eap-tunnel-method-07: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-emu-eap-tunnel-method/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I can't in good conscience make this a DISCUSS point because really, the
best you're going to be able to do is hand-wave or wait on a
not-yet-published document. But 4.2.15 (like a bunch of other documents)
is really introducing an "...a miracle occurs..." solution. It is
presuming that there is a user-input username and password in UTF-8, but
no discussion of normalization or mappings. If you are OK with false
negatives (i.e., in some circumstances people are going to type things
that they are absolutely sure are their usernames and passwords, but they
are going to fail, and they will be unable to type their "true" usernames
or passwords), then you're probably OK doing nothing. If that would be a
really bad outcome, to make it more resilient you could look at:

   http://datatracker.ietf.org/doc/draft-ietf-precis-saslprepbis/

(This document is not just about SASL, the filename notwithstanding.) I'd
like to say that the document will be published quickly, and maybe if you
all pushed on the PRECIS folks it might, but I can't make any promises.
And I wouldn't suggest using RFC 4013, because it's going to be obsoleted
by the above (for good reasons).

I'm glad to discuss this with the authors or the WG, but I won't force
you to DISCUSS it.