Subject: Re: Last Call: draft-siemborski-rfc1734bis (POP3 SASL Authentication Mechanism) to Proposed Standard

From: Philip Guenther <[email-masked]>
Date: Wed, 24 Jan 2007 19:29:48 -0700

On Wed, 24 Jan 2007, The IESG wrote:
> The IESG has received a request from an individual submitter to consider
> the following document:
>
> - 'POP3 SASL Authentication Mechanism '
>   <draft-siemborski-rfc1734bis-10.txt> as a Proposed Standard

My apologies to the authors for not commenting on this document earlier.

Both this document and the related draft-siemborski-rfc2554bis discuss how 
the client can cancel an authentication exchange by sending a line with a 
single "*", but then fail to permit that in the ABNF of what the client 
sends.  The 'auth-resp' production might have been part of an attempt to 
permit that, but it's not referenced or explained.  I therefore suggest 
dropping the dangling 'auth-resp' line and changing this production:

       auth-command    = "AUTH" SP sasl-mech [SP (base64 / "=")] *(CRLF
                         [base64]) CRLF

to something like

       auth-command    = "AUTH" SP sasl-mech [SP (base64 / "=")]
                         *(CRLF [base64]) [ CRLF "*" ] CRLF

or better: it should be consistent with the other document, 
draft-siemborski-rfc2554bis, and have a production for the initial 
response.  One for the cancel response would clarify the usage:

       auth-command    = "AUTH" SP sasl-mech [SP initial-response]
                         *(CRLF [base64]) [CRLF cancel-response] CRLF

       initial-response= base64 / "="

       cancel-response = "*"

A similar change should be made to the rfc2554bis draft.

Otherwise, I support the advancement of this document.  It's definitely an 
improvement over the existing scattering of documents.

Philip Guenther

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 29 Jan 2007 15:05:16 +0000

Philip Guenther wrote:

> Both this document and the related draft-siemborski-rfc2554bis discuss 
> how the client can cancel an authentication exchange by sending a line 
> with a single "*", but then fail to permit that in the ABNF of what 
> the client sends.

Hi Philip,
Good catch.

> The 'auth-resp' production might have been part of an attempt to 
> permit that, but it's not referenced or explained.  I therefore 
> suggest dropping the dangling 'auth-resp' line and changing this 
> production:
>

I've done this change to my copy of rfc2554bis.
Thanks!

> Otherwise, I support the advancement of this document.  It's 
> definitely an improvement over the existing scattering of documents.

---

From: Chris Newman <[email-masked]>
Date: Mon, 29 Jan 2007 19:50:44 -0800

I have reviewed this document and support moving it forward on the standards 
track.

On procedural nit:

In section 4, the document states:
          The service name specified by this protocol's profile of SASL
          is "pop".

A note in the IANA Considerations section is needed which directs IANA to 
update the GSSAPI/SASL service name registry to reference this document.  The 
service name registry is located here:

  <http://www.iana.org/assignments/gssapi-service-names>

                - Chris

The IESG wrote on 1/24/07 16:29 -0500:

> The IESG plans to make a decision in the next few weeks, and solicits
> final comments on this action.  Please send substantive comments to the
> [email-masked] mailing lists by 2007-02-21. Exceptionally,
> comments may be sent to [email-masked] instead. In either case, please
> retain the beginning of the Subject line to allow automated sorting.
>
> The file can be obtained via
> http://www.ietf.org/internet-drafts/draft-siemborski-rfc1734bis-10.txt
>
>
> IESG discussion can be tracked via
> https://datatracker.ietf.org/public/pidtracker.cgi?command=view_id&dTag=10914
> &rfc_flag=0
>
>
> IETF-Announce mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ietf-announce
>