Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords
draft-ietf-precis-7613bis-11

[Ballot comment]
Nit: The final paragraph of section 1 is missing a paren after "[RFC7622]".

Nit: Step 2 in section 4.2.2 cites RFC 4013 as text rather than the normal citation format of [RFC4013]

I have the same comment as I did on rfc7700bis regarding the implications of operation idempotence.

[Ballot comment]
I agree with jsalowey's point about discouraging raw password comparison. Can you do something about that?

The use of "false positive" is confusing because positive can either mean "accept" or "reject". I would use "false accept" or "false reject" or some other clearer term

[Ballot comment]
Taking a page from Benoit's playbook, here is a diff from RFC7613: https://tools.ietf.org/tools/rfcdiff/rfcdiff.pyht?url1=https://tools.ietf.org/id/draft-ietf-precis-7613bis-08.txt&url2=https://tools.ietf.org/rfc/rfc7613.txt
(I feel really stupid for not realizing this earlier, but diff'ing a -bis from the base RFC is a: obvious and b: really useful for understanding which bits need more review)

(Via drafts-lastcall@iana.org): IESG/Authors/WG Chairs:

The IANA Services Operator has completed its review of draft-ietf-precis-7613bis-07.txt. If any part of this review is inaccurate, please let us know.

The IANA Services Operator has a question about one of the actions requested in the IANA Considerations section of this document.

The IANA Services Operator understands that, upon approval of this document, there are three actions which we must complete.

First, in the PRECIS Profiles registry on the Preparation and Comparison of Internationalized Strings (PRECIS) Parameters registry page located at:

https://www.iana.org/assignments/precis-parameters/

there is an existing entry for UsernameCaseMapped.

IANA Question --> Should the reference for this entry be updated to:

[ RFC 7613 ], [ RFC-to-be ], Section 3.2? Has the template changed?

Second, also in the PRECIS Profiles registry on the Preparation and Comparison of Internationalized Strings (PRECIS) Parameters registry page located at:

https://www.iana.org/assignments/precis-parameters/

there is also an existing entry for UsernameCasePreserved.

IANA Question --> As before, should the reference for this entry be updated to:

[ RFC 7613 ], [ RFC-to-be ], Section 3.3? Has the template changed?

Third, also in the PRECIS Profiles registry on the Preparation and Comparison of Internationalized Strings (PRECIS) Parameters registry page located at:

https://www.iana.org/assignments/precis-parameters/

there is also an existing entry for OpaqueString.

IANA Question --> As before, should the reference for this entry be updated to:

[ RFC 7613 ], [ RFC-to-be ], Section 4.2? Has the template changed?

The IANA Services Operator understands that these three actions are the only ones required to be completed upon approval of this document.

Note:  The actions requested in this document will not be completed until the document has been approved for publication as an RFC. This message is only to confirm what actions will be performed.

Thank you,

Sabrina Tanamal
IANA Services Specialist
PTI

The following Last Call announcement was sent out:

From: The IESG
To: IETF-Announce
CC: ben@nostrum.com, Marc Blanchet , precis@ietf.org, Marc.Blanchet@viagenie.ca, precis-chairs@ietf.org, draft-ietf-precis-7613bis@ietf.org
Reply-To: ietf@ietf.org
Sender:
Subject: Last Call:  (Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords) to Proposed Standard


The IESG has received a request from the Preparation and Comparison of
Internationalized Strings WG (precis) to consider the following document: -
'Preparation, Enforcement, and Comparison of Internationalized Strings
  Representing Usernames and Passwords'
  as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2017-06-27. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the beginning of
the Subject line to allow automated sorting.

Abstract


  This document describes updated methods for handling Unicode strings
  representing usernames and passwords.  The previous approach was
  known as SASLprep (RFC 4013) and was based on stringprep (RFC 3454).
  The methods specified in this document provide a more sustainable
  approach to the handling of internationalized usernames and
  passwords.  The preparation, enforcement, and comparison of
  internationalized strings (PRECIS) framework, RFC 7564, obsoletes RFC
  3454, and this document obsoletes RFC 7613.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-precis-7613bis/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-ietf-precis-7613bis/ballot/


No IPR declarations have been submitted directly on this I-D.

This is my AD evaluation of draft-ietf-precis-7613bis-07.

I think this draft is ready for IETF last call, which I will request shortly. I have a few comments, all about references, that I think can be handled along with any last call comments.

- Should the references to RFC 7613 in the IANA considerations be updated to point to this document? (Some _say_ “this document”).

- There are some citations to RFC 4013 and 3545 that seem to be overtaken by events. For example, there is a statement that 4013 is obsoleted by this document, when in fact it was obsoleted by 7613. Please check to make sure that any such citations (and their surrounding context) will still make sense when this draft is published as an RFC.

1. Summary

The document shepherd is Marc Blanchet. The responsible Area Director is Alexey Melnikov.

This document is part of a set of revised RFCs (7564, 7613, 7700), based on implementation experience. 7564 is the base Precis protocol, 7613 and 7700 are profiles for specific use (username/passwords and nicknames respectively).  This revised document, the Precis profile for username and passwords, essentially clarifies the original specification and make it synchronized with the revised base spec, specially regarding case mapping.

2. Review and Consensus

Multiple versions of the revised spec was discussed over more than a year in the working group mailing list. As a clarification of the original profile specification, there was no real contention on the document. A discussion happened on a desirable property of being idempotent, but the discussion went that this is a desirable property, not an absolute requirment.

3. Intellectual Property

Each author has confirmed conformance with BCP 78/79. There are no IPR disclosures on the document.

4. Other Points

No change to IANA Precis registries and related policies

1. Summary

The document shepherd is Marc Blanchet. The responsible Area Director is Alexey Melnikov.

This document is part of a set of revised RFCs (7564, 7613, 7700), based on implementation experience. 7564 is the base Precis protocol, 7613 and 7700 are profiles for specific use (username/passwords and nicknames respectively).  This revised document, the Precis profile for username and passwords, essentially clarifies the original specification and make it synchronized with the revised base spec, specially regarding case mapping.

2. Review and Consensus

Multiple versions of the revised spec was discussed over more than a year in the working group mailing list. As a clarification of the original profile specification, there was no real contention on the document. A discussion happened on a desirable property of being idempotent, but the discussion went that this is a desirable property, not an absolute requirment.

3. Intellectual Property

Each author has confirmed conformance with BCP 78/79. There are no IPR disclosures on the document.

4. Other Points

No change to IANA Precis registries and related policies