Subject: rfc2222bis Appendix C

From: Hallvard B Furuseth <[email-masked]>
Date: Wed, 13 Oct 2004 10:07:41 +0200

I think Appendix C (Changes since RFC 2222) includes an extract of
changes between various rfc2222/rfc2222bis versions, rather than just
changes since RFC 2222.  Examples:

   Replaced UTF-8 ABNF with the reference to the UTF-8 document.

RFC 2222 did not refer to UTF-8 at all.  OTOH, the new UTF-8
MUST/SHOULDs in sections 3.2.2 and 5 are not mentioned.

   Replaced "buffers of security encoded data" with "buffers of
   protected data" for clarity.

That first phrase does not occur in rfc2222.

   Made requirement to verify that an authorization identity is correct
   by performing SASLprep a SHOULD, instead of a MUST.

rfc2222 does not contain a single MUST.  And if that SHOULD is the one
in rfc2222bis 3.2.1, then it is about verifying that ID's _form_ is
correct, not that the ID itself is correct.

Another detail:

   The "SKEY" mechanism described in RFC 2222 is obsolete and has been
   removed.  It has been replaced by the OTP mechanism [SASL-OTP].

This is the only mention of [SASL-OTP] outside of the References
section.  Is that intentional?

-- 
Hallvard

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 13 Oct 2004 11:27:36 +0100

Hallvard B Furuseth wrote:

>changes since RFC 2222.
That is correct.

Question to the WG: should I clean up the Appendix C or should I wait 
till the document is approved for publication?

>[...]
[SASL-OTP] is mentioned in 10.2 (Informative references).

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 13 Oct 2004 10:14:27 -0400

> till the document is approved for publication?

This section is essentially a changelog.  Normally, such sections are 
intended for use during the development of a document, and carry a note to 
the RFC-Editor asking that they be removed prior to publication.  I think 
that would be the apporpriate thing to do in this case.

-- Jeff

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 13 Oct 2004 15:17:26 +0100

Jeffrey Hutzelman wrote:

> This section is essentially a changelog.

Yes.

> Normally, such sections are intended for use during the development of 
> a document, and carry a note to the RFC-Editor asking that they be 
> removed prior to publication.  I think that would be the apporpriate 
> thing to do in this case.

I disagree. I find such section quite useful when one has to quickly 
find out about changes since an older RFC.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 13 Oct 2004 08:50:02 -0700

At 07:17 AM 10/13/2004, Alexey Melnikov wrote:

>Jeffrey Hutzelman wrote:
>
>>On Wednesday, October 13, 2004 11:27:36 +0100 Alexey Melnikov <[email-masked]> wrote:
>>

As the WG must review and reach consensus as to content of
Appendix before it submitted to the AD for consideration,
it should be cleaned up now.

>>This section is essentially a changelog.

When I think of an I-D changelog, I think of a log of changes
between each revision of the I-D.  This is not that. 

>>Normally, such sections are intended for use during the development of a document, and carry a note to the RFC-Editor asking that they be removed prior to publication.

If this appendix were a log of changes between each revision of
the I-D, I would agree.  But this appendix is not that.  It is
summary of changes made to RFC 2222.

>>I think that would be the apporpriate thing to do in this case.
>
>I disagree. I find such section quite useful when one has to quickly find out about changes since an older RFC.

Yes.  The purpose of this section is to provide useful information
to the reader of the RFC regarding changes since RFC 2222.

Kurt

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 13 Oct 2004 17:23:14 +0100

>it should be cleaned up now.
Ok.

The more precise questions are:
1). Do we want to keep it (the answer I got so far is "yes")
2). Do we want to keep list of changes between drafts, as well as 
changes since RFC 2222? The former will be deleted before publication.

>between each revision of the I-D.  This is not that. 
In practice it is kind of "in between". I was updating it each time a 
major change was done, but each change was only recorded once (even if 
multiple revisions had to deal with the same change).

Alexey

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 13 Oct 2004 09:43:51 -0700

>1). Do we want to keep it (the answer I got so far is "yes")

Yes.  When revising an existing RFC, it is generally appropriate
to summarize the changes made.  This information is quite
useful to readers of the new RFC, especially to those who
implemented the existing RFC.

>2). Do we want to keep list of changes between drafts, as well as changes since RFC 2222? The former will be deleted before publication. 

First, if such a list is maintained, it must be maintained
separately from the above summary.

Anways, (as you note) such a list would not be subject to WG
review as it would be removed prior to publication.  Though
some WG find such lists useful, they are certainly not necessary.
Given that this document is already through WG last call, I
don't see how such a list could be useful to the WG
or during subsequent IETF and IESG review.  Personally, I
think our energy would be better spent ensuring the
summary of changes since RFC 2222 was of good quality.

So, no.

Kurt

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 13 Oct 2004 18:18:21 +0100

>   protected data" for clarity.
This should read:

Replaced "buffers of cipher-text" with "buffers of protected data" for 
clarity.

>   by performing SASLprep a SHOULD, instead of a MUST.
I've changed this to:

   by performing SASLprep.

Is this better?

---

From: Hallvard B Furuseth <[email-masked]>
Date: Fri, 15 Oct 2004 02:47:40 +0200

>    Made requirement to verify that an authorization identity is correct

No, because it's not a requirement:-) Anyway, I think this paragraph can
simply be deleted, since it's just part of the 'I-D revision history'.
The appendix already covers SASLprep as RFC history:

   Added text about SASLprep for authentication identities and
   passwords.  Described where SASLprep preparation should take place.

-- 
Hallvard

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 15 Oct 2004 10:21:33 +0100

Hallvard B Furuseth wrote:

>No, because it's not a requirement:-)
>
Fine, but see below.

> Anyway, I think this paragraph can
This doesn't cover authorization identities.

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 13 Oct 2004 11:27:36 +0100

That is correct.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 13 Oct 2004 10:14:27 -0400

-- Jeff

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 13 Oct 2004 15:17:26 +0100

Yes.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 13 Oct 2004 08:50:02 -0700

Kurt

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 13 Oct 2004 17:23:14 +0100

Ok.

Alexey

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 13 Oct 2004 09:43:51 -0700

So, no.

Kurt

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 13 Oct 2004 18:18:21 +0100

This should read:

I've changed this to:

Is this better?

---

From: Hallvard B Furuseth <[email-masked]>
Date: Fri, 15 Oct 2004 02:47:40 +0200

-- 
Hallvard

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 15 Oct 2004 10:21:33 +0100

Fine, but see below.