Subject: [sidr] Comments on sidr-res-certs-15

From: Danny McPherson <[email-masked]>
Date: Wed, 3 Dec 2008 11:54:10 -0700

Geoff/George/Robert,
Some belated comments on this draft.  I hope most
help contribute tot he accuracy of the document
prior to publication, as many are trivial.

Thanks!

-danny

---
Substantial Comments

I already provided comments on my concern with the significant
set of changes that were added post WG LC in S 6.3 and beyond
in the -15 revision.  I would like to see discussion of these
on the WG mailing list, and perhaps even suspect some of that
would be more suitable for the sidr-arch draft, rather than
this draft.

---
Mostly Editorial Comments Below

-
Boilerplate update to 4748 will be required when new
revision is issued.

-
S 1.

I believe it would be worthwhile in the beginning to
define "number registry", as that term is used both
frequently and rather ambiguously throughout.

In the second to last graf you mention a use case
regarding "the detection of potential unauthorized
use of IP addresses", can you explain what this means?

-
S 3.2.

Regarding Serial number, did you really mean "unique per
Issuer", or "unique for each certificate issued"?

-
S 3.4.

The second graf here suggests that ID.sidr-arch imposes
conventions on Issuer names in resources certificates.  I
don't believe it does.  It talks about Subject names, but
not issuers names.  Perhaps you can clarify for me?

-
S 3.7.

s/current time,/current time./

-
S 3.9.1.

Need consistent capitalization of "basic constraints", varies
within this section, as well as in other sections (e.g. 6.3.1)
-
S 3.9.5.

s/implying at/implying that/

-
S 3.9.7.

s/is referenced the/is referenced in the/

-
S 3.9.8.

s/none must/MUST NOT/

-
S 6.2.

Regarding "It is suggested that implementations of Resource
Certificate validation MAY halt with a validation failure if
the certification path length exceeds a locally defined
configuration parameter.", do you have an indication of what
might be reasonable here in practice?

-
S 6.3.

Third graf, use of "registry" is rather ambiguous again.

s/must be a superset/MUST be a superset/ ?
s/thought not mandated/though not mandated/

-
S 6.3.1.

s/fof those/of those/

-
S 8.

s/[RFC3779]apply/[RFC3779] apply/

_______________________________________________
sidr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sidr

---

From: Danny McPherson <[email-masked]>
Date: Wed, 3 Dec 2008 14:38:57 -0700

One other trivial comment here:

S 3.9.7.  expands SIA to "Subject Information Access",
rather than "Subject Information Authority".

An earlier version of the respos-struct draft did the
same, but it was corrected.

-danny

---

From: Danny McPherson <[email-masked]>
Date: Wed, 3 Dec 2008 15:13:45 -0700

Question about "multi-use" EEs..  The repos-struct-01
draft seems to suggest that they're "defined" in the
res-certs draft:

"2.1.  Manifests

    All CA's and all EE's that have repository publication points
    ("multi-use" EE certificates, as defined in
    [I-D.ietf-sidr-res-certs])..."

But the only text in the res-certs draft regarding
multi-use certs is in S 7:

"In the case of a "multi-use" EE certificate, the EE
certificate should issued using the CURRENT CA."

Does something more need to be provided to define this term
here?

Also, S 7. Bullet 6 (within key rollover operation) of
res-certs-15:

s/should issued using/should be issued using/

-danny