Subject: Genart last call review of draft-ietf-curdle-cms-eddsa-signatures-06

From: Jouni Korhonen <[email-masked]>
Date: Sun, 23 Jul 2017 13:41:28 -0700

Reviewer: Jouni Korhonen
Review result: Ready

I am the assigned Gen-ART reviewer for this draft. The General Area
Review Team (Gen-ART) reviews all IETF documents being processed
by the IESG for the IETF Chair.  Please treat these comments just
like any other last call comments.

For more information, please see the FAQ at

<https://trac.ietf.org/trac/gen/wiki/GenArtfaq>.

Document: draft-ietf-curdle-cms-eddsa-signatures-??
Reviewer: Jouni Korhonen
Review Date: 2017-07-23
IETF LC End Date: 2017-07-25
IESG Telechat date: Not scheduled for a telechat

Summary: Ready to ship. Good that Proto Write-up took care of explaining
downrefs.

Major issues: None.

Minor issues: None.

Nits/editorial comments:  I just have one question whether the use of RFC2119
language in Section 5 Security Considerations is intentional? I mean here that
sometimes e.g. "must" is in lower case and sometimes other keywords are in
upper case e.g. "SHOULD NOT".

---

From: Russ Housley <[email-masked]>
Date: Mon, 24 Jul 2017 16:57:58 -0400

Jouni:

Thanks for the review.

> upper case e.g. "SHOULD NOT".

Looking through the paragraphs in Section 5...

Paragraph 1: The use of "must" and "may" are intentional.  These are needed for security, but they do not impact interoperability.

Paragraph 2: The use of "may" is intentional.  It is a statement about what an attacker may do; it has no impact on interoperability.

Paragraph 4: It uses "SHOULD NOT"

Paragraph 5: In my edit buffer, I have changed "should" to "SHOULD".

Russ