Last Call Review of draft-giralt-schac-ns-
review-giralt-schac-ns-secdir-lc-lonvick-2009-12-31-00

Hi,

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.



First off, can we get the status of the document straightened out?  The 


document says that it's STANDARDS TRACK but idtracker says that it's 


INFORMATIONAL.






The only security concern I have is that the registration URN is not yet 


active and that it is limited to HTTPS.  While I think it is still going 


to take some time for this ID to become an RFC, I'd just like to see the 


web site set up sooner rather than later so the kinks may be ironed out. 


Beyond that, I think that it would be better to state that it will always 


be a "secure web site" which will offer credentials signed by such-n-such, 


and will require the latest secure methods for accessing a web site; that 


currently being http [reference] with the latest TLS transport 


[reference].  My issue with this is that "https" can still reference SSLv2 


and I don't think that's the intent of the statement in this ID.






I don't have any concerns about the Security Considerations section other 


than the statement about using "HTTPS" as noted above.




I do have a few nits that the authors may want to address.



The terms TERENA and TF-EMC2 are used without first defining them.  Maybe 


some changes in Section 1.



CURRENT:
   The SCHAC international activity was born inside the TF-EMC2
   middleware task force of the Trans European Research and Education
   Network Association.  The initial aim of SCHAC was to harmonise the
PROPOSED:
   The SCHAC international activity was born inside the TF-EMC2 (Task
   Force on European Middleware Coordination and Collaboration)
   of the Trans European Research and Education Network Association
   (TERENA).  The initial aim of SCHAC was to harmonise the...



I think that the second paragraph of the Abstract could use some 


polishing.



CURRENT:
   This namespace is for naming persistent resources defined by the
   SCHAC international activity participants, their working groups and
   other designated subordinates.  The namespace main use will be the
   creation of controlled vocabulary values for attributes in the SCHAC
   schema.  This values will be associated to particular instances of
   persons or objects belonging to any of the SCHAC object classes.
SUGGESTED:
   The namespace described in this document is for naming persistent
   resources defined by the SCHAC participants internationally, their
   working groups, and other designated subordinates.  The main use of
   this namespace will be for the creation of controlled vocabulary values
   for attributes in the SCHAC schema.  These values will be associated
   with particular instances of persons or objects belonging to any of the
   SCHAC object classes.



In Section 4, the word "Anyhow" is ambiguous.  I'd suggest replacing it 


with a more definite word such as "Regardless", or with the term "In any 


case".






In Section 5, the term "NREN" is not defined before it is used.  I'd 


suggest:



CURRENT:
   The assignment and use of identifiers within the namespace are open,
   and the related rule is established by the SCHAC activity members.
   Registration agencies (the next level naming authorities) will be the
   National Research and Education Networks and established
   organizational cross-border organizations that participate in SCHAC.
SUGGESTED:
   The assignment and use of identifiers within the namespace are open,
   and the related rule is established by the SCHAC activity members.
   Registration agencies (the next level naming authorities) will be the
   National Research and Education Networks (NRENS) and other established,
   cross-border organizations that participate in SCHAC.



In the third paragraph of Section 5, remove the term "as soon as 


practical".  ...just get it done.  :-)




Could you add a URL to reference [4]?

Best regards,
Chris