draft-ietf-rap-rsvp-authsession-04.txt

All,

As you may have seen, a new revision of the AUTH_SESSION draft was
submitted. The new revision was done
to address the comments raised during IESG review, specifically from the
Security AD - Steven Bellovin.

Here is a summary of the comments received from the Security AD:
-Lack of detail regarding the security mechanisms described in the draft.
Concerns that this lack of detail
may not allow implementers to build interoperable systems.

Here is a summary of the changes.

- Terminology: Change the use of "shared private keys" to "shared symmetric
keys"
- Section 4.2: Kerberos -  Added more details on how to use Kerberos to
ensure the integrity of the token.
- Added Sub-Section 4.3.1.1: X.509 V3 digital certificates. This sub-section
was added to provide the details on how to use
X.509 V3 digital certificates to ensure the integrity of the token.
- Added Sub-Section 4.3.1.2: PGP Digital Certificates. This sub-section was
added to provide the details on how to use PGP
digital certificates to ensure the integrity of the token.
- Added more details in section 6: Message processing rules. Basically,
provided better guidance.
- Changed the title of the draft to "Session authorization Policy Element".
This title is much more appropriate since this document's
main goal is the describe the AUTH_SESSION Policy Element.
- Security considerations section: Specified the need for NTP in the
non-associated model to ensure proper clock synchronization.
- Clarified that fields of subtype UNICODE_DN are X.500 Distinguished name
as defined in RFC-2253 as a UTF-8 string.

We worked directly with Steven to make sure we successfully addressed all of
his concerns - thanks to Bert for facilitating
this interaction. Thanks also to Eric Rescorla for providing security
advice. 

Cheers,
Louis-Nicolas