Subject: rfc2222bis Appendix C

From: Hallvard B Furuseth <[email-masked]>
Date: Wed, 13 Oct 2004 10:07:41 +0200

I think Appendix C (Changes since RFC 2222) includes an extract of
changes between various rfc2222/rfc2222bis versions, rather than just
changes since RFC 2222.  Examples:

   Replaced UTF-8 ABNF with the reference to the UTF-8 document.

RFC 2222 did not refer to UTF-8 at all.  OTOH, the new UTF-8
MUST/SHOULDs in sections 3.2.2 and 5 are not mentioned.

   Replaced "buffers of security encoded data" with "buffers of
   protected data" for clarity.

That first phrase does not occur in rfc2222.

   Made requirement to verify that an authorization identity is correct
   by performing SASLprep a SHOULD, instead of a MUST.

rfc2222 does not contain a single MUST.  And if that SHOULD is the one
in rfc2222bis 3.2.1, then it is about verifying that ID's _form_ is
correct, not that the ID itself is correct.

Another detail:

   The "SKEY" mechanism described in RFC 2222 is obsolete and has been
   removed.  It has been replaced by the OTP mechanism [SASL-OTP].

This is the only mention of [SASL-OTP] outside of the References
section.  Is that intentional?

-- 
Hallvard