Subject: rfc2222bis comments

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Fri, 06 Jun 2003 18:18:49 -0700

I have a few technical comments for the WG to consider.
(I also have a number of editorial comments which I send
directly to the editor.)

I suggest we change the 20 character maximum length to a
higher number so that OIDs can be more easily used as mechanism
names.  I don't think this will break anyone... and it will make
GSS API mechanism specification much easier.

The "authorization identity" should clearly be described as an
an optional proxy authorization identity.  Empty and no strings
are semantically equivalent. Mechanisms should not allow both
empty and no string to be transferred (we've had interop problems
with DIGEST-MD5 and EXTERNAL because implementations didn't always
treat them as being the same).  Also, replace "entire repertoire
of Unicode Normalization form KC [UNICODE-NORMALIZATION]" with
"entire Unicode repertoire".  Also, use same repertoire here
in first paragraph of 4.2.

The last paragraph of 4.2 needs some word-smithing.

The wording of this section 5 paragraph is problematic.
>   A protocol profile MAY further refine the definition of an         
>   authorization identity by adding additional syntactic restrictions
>   and protocol-specific semantics.

Profiles MUST specify the form of the authorization identity
well as how authorization identities are to be compared.  It
may be appropriate to encourage use of simple user names here
(and, hence, SASLprep).

More later....