Brian asked me to
review draft-ietf-msec-ipsec-group-counter-modes-02 and I finally got around to
it. All my comments are minor clarification suggestions and/or
questions so I'll leave it up to the authors whether to address the
issues.
My
comments:
1. there is no
mention of an approved method to generate the SID. I assumed it's
some acceptable method of generating random numbers.
2. There is a
statement about the conforming implementation to support SID lengths of 8, 12,
16. Why is this?
3. Examples of the
IV with a specific SID length would be useful in the context of a few senders
with the same SA and a different SA.
4. In section 4, it
says "A GKMS MUST support a GM notifying the GCKS that its IV space will soon be
exhausted ..", and later that "A GCKS MAY choose to ignore this notification
based on policy ...".
Maybe I've
misunderstood something here?
Otherwise the draft
looks good as is.
thanks,
Sheela