Subject: [Gen-art] Gen-ART LC review of draft-harkins-ipsecme-spsk-auth-03

From: "Roni Even" <[email-masked]>
Date: Mon, 11 Apr 2011 15:11:55 +0300

I am the assigned Gen-ART reviewer for this draft. For background on
Gen-ART, please see the FAQ at
<http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>.

Please resolve these comments along with any other Last Call comments you
may receive.

Document: draft-harkins-ipsecme-spsk-auth-03

Reviewer: Roni Even

Review Date:2011-4-11

IETF LC End Date: 2011-4-23

IESG Telechat date:

Summary: This draft is almost ready for publication as an Experimental RFC.

Major issues:

Minor issues:

1.	In section 8.5 and 8.6 the draft says that "If no more password
pre-processing techniques are supported the exchange MUST be   terminated."
Reading section 6, I thought that NONE MUST be supported for
interoperability purpose.
2.	In section 8.1 and in figure 1 and figure 2 is there a maximum value
for "counter"?

Nits/editorial comments:

1.       In section 1 just before 1.1 you have "suceed" instead of "succeed"

2.       In section 4 third bullet "an" instead of "and"

3.       In section 4.2 "Two elementx" instead of "Two elements"

4.       In section 5 second row "authenticaiton" should be "authentication"

5.       In section 6 fourth row "identitcal" instead of "identical"

---

From: "Dan Harkins" <[email-masked]>
Date: Thu, 21 Apr 2011 17:39:10 -0700 (PDT)

Hi Roni,

  Thank you for reviewing my draft. Comments inline....

> interoperability purpose.

  One of the valid techniques for password pre-processing is "none".
That doesn't mean that there isn't a technique, it means the technique
is to perform no pre-processing on the password (treat it as a raw
blob of bits).

> 2.	In section 8.1 and in figure 1 and figure 2 is there a maximum value

  No there isn't, but it is doubtful the number will get very large.
The probability that more than n iterations is necessary will be
roughly (1-(r/2p))^n, where r is the order and p is the prime, and
that number rapidly approaches zero as n increases.

> 5.       In section 6 fourth row "identitcal" instead of "identical"

  Thank you for catching all of these.

  regards,

  Dan.

---

From: "Roni Even" <[email-masked]>
Date: Fri, 22 Apr 2011 22:25:00 +0300

Hi Dan,
About my first  comment what I meant that section 6 say "   For the purposes
of interoperability, a password pre-processing technique of "None" MUST be
supported.". I now understand that in section 8.5 and 8.6 you say that the
initiator may decide not to use the "none" technique and therefore may not
find an interoperable mode. 
If the initiator will use "none" technique than you will have
interoperability. 
Roni

> -----Original Message-----
> From: Dan Harkins [mailto:[email-masked]]
> Sent: Friday, April 22, 2011 3:39 AM
> To: Roni Even
> Cc: [email-masked]; gen-
> [email-masked]; 'IETF-Discussion list'
> Subject: Re: Gen-ART LC review of draft-harkins-ipsecme-spsk-auth-03
> 
> 
>   Hi Roni,
>