Re: secdir review of draft-ietf-secsh-publickey-subsystem-07.txt

[Jon Bright <jon%siliconcircus.com@localhost>]

Hi Sam,

Short replies to your comments below.  Thanks for the review.

Sam Weiler wrote:
> Substance:
>
> Section 4.3: Noticing that there's no way to revoke all keys without
> explicitly naming them, i'm wondering if it would be wise to say that
> implementations SHOULD support the 'list' operation.  (Or, 
> alternatively, add a 'revoke all' command.)

I've change the "MAY not..." text to a "SHOULD".

> Section 4.1: It's not clear to me whether the "from" list contains 
> hostnames, IP addrs, or ...?  Perhaps be a bit more specific.

I've added the following text: "For IP-based networks, it is anticipated 
that the "from" parameter will take the form of a specific IP address or 
hostname."

> Section 1 uses a 2119 SHOULD: "If password authentication is used,
> servers SHOULD provide a configuration option to disable the use of
> password authentication after the first public key is added."  Is that
> 2119 SHOULD really necessary?

Following the comments from Jeffrey Hutzelman and Sam Hartman, I've not 
changed this text.

> I was not entirely clear until section 3 that this doc was talking
> about USER keys.  Please say that more explicitly in both the abstract
> and introduction.

In both the abstract and introduction, I've swapped "...defines an 
authentication mechanism..." for "...defines a user authentication 
mechanism...".

> Throughout, the doc talks about "packets" instead of "messages"
> (e.g. in section 3, "the server sends response packets" or in section
> 3.4, "...the first 15 bytes of the version packet") -- is that really
> the appropriate term in this context?

As noted by Jeffrey Hutzelman, it's consistent with SSH terminology.

> Section 3.4 mentions that this is version 2 of the protocol.  I'd
> appreciate a historical note re: where version 1 is defined or, if it 
> wasn't defined, why we're using version #2.

I've added the following sentence: "Version 1 was used by an early draft 
of this document.  The version number was incremented after changes in 
the handling of status packets."

> Section 3.1 uses the phrase "...close the subsystem", which seems a
> bit unusual.  Is that usage consistent with the rest of the SSH docs?

See Jeffrey Hutzelman's note on this.

--
Jon Bright
Silicon Circus Ltd.
http://www.siliconcircus.com