Subject: [Gen-art] Gen-art review of draft-ietf-radext-rfc4590bis-01.txt

From: Gonzalo Camarillo <[email-masked]>
Date: Tue, 22 May 2007 13:57:19 +0300

Hi,

I have been selected as the General Area Review Team (Gen-ART)
reviewer for this draft (for background on Gen-ART, please see
http://www.alvestrand.no/ietf/gen/art/gen-art-FAQ.html).

Please resolve these comments along with any other Last Call comments
you may receive.

Draft: draft-ietf-radext-rfc4590bis-01.txt
Reviewer: Gonzalo Camarillo <[email-masked]>
Review Date: 22 May 2006

Summary:

This draft is ready for publication as a PS RFC.

Comments:

RFC 3579, which appears in the References, is an Informational RFC
(i.e., it is a down reference).

Section 2.1 explains that information sent over a TLS connection to the
RADIUS client may be sent in cleartext to the RADIUS server, but does
not give any recommendation on what to do in that case. A further
explanation or a recommendation would be useful.

Thanks,

Gonzalo

_______________________________________________
Gen-art mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/gen-art

---

From: David Williams <[email-masked]>
Date: Wed, 23 May 2007 15:55:10 -0400 (Eastern Daylight Time)

> (i.e., it is a down reference).

Meaning this should appear in section 9.2 instead of 9.1?  Or that the 
text should some somehow refer back to some standard reference versus 
rfc3579.  Sorry for my ignorant question.

> explanation or a recommendation would be useful.

This is discussed more in Section 8.2.   What is the best way to approach 
this, prehaps by adding a sentence to the end of the paragraph like:

"2.1 RADIUS Client Behavior

The attributes described ..... result in information 
intentionally protected by HTTP-style clients being sent in the clear 
during RADIUS exchange.  Ways to mitigate this exposure are discussed in 
section 8.2"

Or is it prefered to summarize the problem in section 2.1.

thanks,
-david

---

From: Gonzalo Camarillo <[email-masked]>
Date: Thu, 24 May 2007 09:37:39 +0300

Hi,

> rfc3579.  Sorry for my ignorant question.

it is just that when a document at a given level (Standards-track in 
this case) normatively references another document at a lower level 
(Informational in this case) it needs to be noted in the IETF LC so that 
reviewers and the IESG decide whether or not such a down reference is 
appropriate.

This is because Standards-track documents have higher requirements than 
Informational documents.

In short, as long as the ADs know about this downref and are OK with it, 
there is no problem.

Cheers,

Gonzalo