Subject: Re: [sipcore] New Version Notification for draft-yusef-sipcore-digest-scheme-03.txt

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Mon, 20 Jan 2014 09:07:37 -0500

Hi,

I think that with this version I have addressed all the comments I received
so far.
Please, take a look and let me know if you have any further comments.

Regards,
 Rifaat

On Mon, Jan 20, 2014 at 9:05 AM, <[email-masked]> wrote:

>
> A new version of I-D, draft-yusef-sipcore-digest-scheme-03.txt
> has been successfully submitted by Rifaat Shekh-Yusef and posted to the
> IETF repository.
>
> Name:           draft-yusef-sipcore-digest-scheme
> Revision:       03
> Title:          The Session Initiation Protocol (SIP) Digest
> Authentication Scheme
> Document date:  2014-01-20
> Group:          Individual Submission
> Pages:          8
> URL:
> http://www.ietf.org/internet-drafts/draft-yusef-sipcore-digest-scheme-03.txt
> Status:
> https://datatracker.ietf.org/doc/draft-yusef-sipcore-digest-scheme/
> Htmlized:
> http://tools.ietf.org/html/draft-yusef-sipcore-digest-scheme-03
> Diff:
> http://www.ietf.org/rfcdiff?url2=draft-yusef-sipcore-digest-scheme-03
>
> Abstract:
>    This document updates the Digest Access Authentication scheme used by
>    the Session Initiation Protocol (SIP) to add support for SHA2 digest
>    algorithms to replace the MD5 algorithm.
>
>
>
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
>

---

From: Paul Kyzivat <[email-masked]>
Date: Mon, 20 Jan 2014 11:33:41 -0500

On 1/20/14 9:07 AM, Rifaat Shekh-Yusef wrote:
> Hi,
>
> I think that with this version I have addressed all the comments I
> received so far.

I think this covers my concerns with this document. But I'm now too 
close to it, so I want to hear what others have to day.

My concern now moves to draft-ietf-httpauth-digest, which I guess is 
being discussed in a wg I don't follow. I have some of the same issues 
with it - that while there is a registry, the text is specific to 
particular algorithms, not to an arbitrary registered algorithm. And 
whether there is sufficient information in the registry. (Maybe there 
is, I'm just not sure.)

I see that "Preference" is in the registry. Because these values are 
sequential integers, there may be a problem if a new algorithm needs to 
fit in between two existing ones. As things stand, that would require 
renumbering some of the existing ones. That is a little messy. Perhaps 
you could make the preference be a real number, so that it would always 
be possible to slip a new value between any two existing values.

Also, in some cases the choice of priority value may be controversial. 
With the registration policy being "Specification Required", the 
decision would ultimately be up to the designated expert. May want to 
think about that - is that appropriate? Or do we need IETF Review for that?

	Thanks,
	Paul

> Regards,
>   Rifaat
>
>
>
>
> On Mon, Jan 20, 2014 at 9:05 AM, <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>
>     until the htmlized version and diff are available at tools.ietf.org
>     <http://tools.ietf.org>.
>
>     The IETF Secretariat
>
>
>
>
> _______________________________________________
> sipcore mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sipcore
>

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Mon, 20 Jan 2014 13:39:53 -0500

Inline...

On Mon, Jan 20, 2014 at 11:33 AM, Paul Kyzivat <[email-masked]>wrote:

> I think this covers my concerns with this document. But I'm now too close
> to it, so I want to hear what others have to day.
>
> My concern now moves to draft-ietf-httpauth-digest, which I guess is being
> discussed in a wg I don't follow. I have some of the same issues with it -
> that while there is a registry, the text is specific to particular
> algorithms, not to an arbitrary registered algorithm. And whether there is
> sufficient information in the registry. (Maybe there is, I'm just not sure.)
>
> Yes, you are right. I am planning on fixing the text in the next version
of the draft.

> sequential integers, there may be a problem if a new algorithm needs to fit
> in between two existing ones. As things stand, that would require
> renumbering some of the existing ones. That is a little messy. Perhaps you
> could make the preference be a real number, so that it would always be
> possible to slip a new value between any two existing values.
>
> I was thinking about that too, and I was considering making the Preference
a series with a step of 10 or 100 to address this issue. But using real
numbers is probably a better idea as it is unbounded, although I am not
sure that is really needed, the unbounded aspect that is.

> With the registration policy being "Specification Required", the decision
> would ultimately be up to the designated expert. May want to think about
> that - is that appropriate? Or do we need IETF Review for that?
>
> Ok. I need to read the document that describes the various options to
refresh my memory with all available options and the implication of each
one.