IMAP URL Scheme
draft-ietf-lemonade-rfc2192bis-09

[Ballot discuss]
Section 10.1 says:
>    The "user+" access identifier limits resolution of that URL
>    to a particular userid, whereas the "submit+" access iden-
>    tifier is more general and simply requires that the session be
>    authorized by a user that has been granted a "submit" role within
>    the authentication system.  Use of either of these access identi-
>    fiers makes it impossible for an attacker, spying on the session,
>    to use the same URL, either directly or by submission to a message
>    submission entity.











I don't understand how the last sentence is true at all.

[Ballot comment]
Please turn off hyphenation.

  At the bottom of each page, I expect the authors to be
  "Melnikov & Newman" (not "Newman & Co").

  It looks like the usual postprocessor was not used since the
  bottom of each page includes "FORMFEED[Page x]".

  Section 6.1.1.2 says:
  >
  > The mailbox access key is a random string with at least 128 bits of
  > entropy.  It is generated by software (not by the human user), and
  > MUST be unpredictable.
  >
  As written, I do not think this is an easily tested MUST statement.
  So, I suggest dropping the MUST statement.  I propose:
  >
  > The mailbox access key is an unpredictable, random string.  To
  > ensure unpredictability, the random string with at least 128 bits of
  > entropy is generated by software or hardware (not by the human user).

IANA Evaluation Comments:

Upon approval of this document, the IANA will make
the following changes in "Uniform Resource Identifer
(URI) Schemes" registry located at

http://www.iana.org/assignments/uri-schemes.html

[sub-registry "Permanent URI Schemes"]

OLD:
URI Scheme Description Reference
---------- ----------- ---------
imap internet message access protocol [RFC2192]

NEW:
URI Scheme Description Reference
---------- ----------- ---------
imap internet message access protocol [RFC-lemonade-rfc2192bis-07]

We understand the above to be the only IANA Action
for this document.

As I'm a co-editor for this document, I have to recuse myself from the
IESG process.

This document is a revision of RFC 2192 (the first RFC I wrote) that
folds in changes from RFC 4467 (URLAUTH) so the URL scheme is documented
in one place.  This replaces the portion of RFC 4467 that extends the
IMAP URL scheme, but does not replace the portion of RFC 4467 that
extends IMAP.  Although Alexey did almost all of the work on this
revision, it still contains a large amount of text I wrote and thus it
would be inappropriate for me to be responsible AD for this document.

Passing AD ownership to Lisa.

PROTO Write-up

(1.a) Document Shepherd: Eric Burger, eburger@bea.com, personally reviewed
this document. This document is ready for publication.

(1.b) Work group review: The lemonade work group provided review of this
document.

(1.c) Further review required: This document does not need further
specialized review, as it has received review by many members of the IMAP
community. There are no concerns regarding internationalization, as one of
the co-editors is an expert on internationalization.

(1.d.i) Document Shepherd Comfort Level: High
(1.d.ii) Document Useful and Needed: Yes
(1.d.iii) IPR Disclosures: None known

(1.e) Work Group Consensus: There is a solid WG consensus behind the
document.

Note that the document is a normative dependency of the Lemonade Profile
Bis document.

(1.f) There are no members with objections or concerns. There are no
threats of appeal or process issues.

(1.g.i) ID-nits: Checked and verified with idnits 2.04.07; warnings are a
lack of TOC, a lack of (or rather, bizarre) page separators, an incorrectly
identified unused reference [DATETIME] which appears in an ABNF comment, and
the self-reference RFCXXXX. The real errors of the page separators and the
self-reference are for the RFC Editor to correct.

(1.g.ii) MIB Doctor: Not applicable
(1.g.iii) Media Type: Not applicable
(1.g.iv) URI Type: As it defines a URI scheme, it should have URI expert
review. Ted Hardie, one of the URI experts, reviewed the document.
However, I forgot to send a note to the URI review list. That will happen
in parallel with this request to publish.

(1.h.i) Reference split: Yes
(1.h.ii) Downward normative references: No
(1.h.iii) References to drafts: No

(1.i) IANA Considerations: Yes, correct, consistent, and follows RFC 3501
rules.

(1.j) ABNF: Passes Bill's ABNF parser.

(1.k) Document Announcement:

Technical Summary

IMAP (RFC 3501) is a rich protocol for accessing remote message stores.
It provides an ideal mechanism for accessing public mailing list
archives as well as private and shared message stores. This document
defines a URL scheme for referencing objects on an IMAP server.

This document obsoletes RFC 2192 and updates RFC 4467.


Working Group Summary
This document removed support for IMAP URLs for listing the contents of a
mailbox. There was a clear consensus that this feature (originally
described in RFC 2192) was never implemented.

Some of the changes to the document were a result of the Lemonade
interoperability event of October 2006 held in London, England.

Document Quality

The document received several positive reviews. In particular it is
worth noting Ted Hardie and Zoltan Ordogh have done detailed reviews of the
document. This document addresses all issues raised.

Personnel
Eric Burger shepherds this document on behalf of Chris Newman, the
responsible Area Director. Eric Burger reviewed this document and
believes it is ready for forwarding to the IESG for publication.