Last Call Review of draft-ietf-lamps-crmf-update-algs-04
review-ietf-lamps-crmf-update-algs-04-genart-lc-robles-2021-03-26-00

I am the assigned Gen-ART reviewer for this draft. The General Area
Review Team (Gen-ART) reviews all IETF documents being processed
by the IESG for the IETF Chair.  Please treat these comments just
like any other last call comments.

For more information, please see the FAQ at

<https://trac.ietf.org/trac/gen/wiki/GenArtfaq>.

Document: draft-ietf-lamps-crmf-update-algs-04
Reviewer: Ines Robles
Review Date: 2021-03-26
IETF LC End Date: 2021-03-26
IESG Telechat date: Not scheduled for a telechat

Summary:

The document updates the cryptographic algorithm requirements for the
Password-Based Message Authentication Code in the Internet X.509 Public Key
Infrastructure Certificate Request Message Format (CRMF).

The document is well written, I have minor comments/questions to the authors.

Major Issues: None

Minor Issues: None

Nits/Comments:

1- Introduction: "however, these algorithms are no longer
   considered the best choices. " => It would be nice to add 1 or more
   sentences explaining why they are no longer the best choices

2- Page 3: "id-PasswordBasedMAC as presented in Section 4.4 of this document"
It should be perhaps be "id-PasswordBasedMAC as presented in Section 4.4 of
[RFC4211]" ?

3- If this document does not present privacy considerations, should it be
explicitly mentioned in Section 6?

4- Since the new updates include the use of PBMAC1, HMAC-SHA256, AES-GMAC AES.
Should Section 6 include considerations about them or point to place where to
find them? e.g. For information on security considerations for PBMAC1 see
[rfc8018#section-8].

Thank you for this document,

Ines.