12. (2004-06-10, 12:43:01)bellovin:

 > 5.2.2: Clarify that options after the signature option MUST always be
 > ignored (or the packet dropped); in this context, it's ambiguous
 > if such options are only dropped for purposes of signature
 > verification.

Reply:

Agree, text will be modified accordingly.

13. (2004-06-10, 12:43:01)bellovin:

 > 5.2.4 says that the IPv6 header is covered by the signature.  5.2.1
 > says that the ICMPv6 header is covered, as well as the source and
 > destination addresses.  Which is it?

Reply:

It's the entire packet, including IPv6 header. We will add that to 5.2.1.

14. (2004-06-10, 12:43:01)bellovin:

 > 5.3.4.2: A 1-hour DELTA value seems amazingly high.  Kerberos uses 5 minutes.

Reply:

We will change it to 5 minutes.