draft-ietf-ipo-framework-04

[Russ Housley <housley@vigilsec.com>]

  Figure 1 is messed up.  For example, one of the lines is 370 characters 
long.  Long lines appear elsewhere too.

  Section 9.1 says:

     1. Replay protection, which detects and rejects attempts to
        reorder, duplicate, truncate, or otherwise tamper with the
        proper sequence of messages, and

  This is not quite right.  Replay mechanisms do not provide 
connection-oriented data integrity.  Replay mechanisms allow reorder within 
a window, and truncation protection is not provided.

  Section 9.1 also says:

     2. Non-repudiation, which may be desirable for accounting and
        billing purposes.

   Non-repudiation is an application layer security service.  I am 
surprised to see it in this document.