Subject: [lamps] WG Last Call for draft-ietf-lamps-documentsigning-eku-02

From: Russ Housley <[email-masked]>
Date: Mon, 7 Mar 2022 16:54:19 -0500

Title: General Purpose Extended Key Usage (EKU) for Document Signing X.509 Certificates

Authors: Tadahiko Ito, Tomofumi Okubo, Sean Turner

Datatracker: https://datatracker.ietf.org/doc/draft-ietf-lamps-documentsigning-eku

This document will assign a new extended key purpose identifier for document signing.  The WG Last Call will run until Tuesday, March 29th. This is a little longer than normal because of IETF 113.  Please review the document and respond with any comments or concerns on the mail list.

For the LAMPS WG Chairs,
Russ

---

From: Prachi Jain <[email-masked]>
Date: Tue, 8 Mar 2022 09:42:01 -0600

Hello All,

First of all, I want to say that this document is very well written, clear
and succinct. Congratulations on that !!

One feedback which I have and believe will be very helpful to add is
'criticality'. The document does not mention anything about
marking/not-marking this extension as 'critical'.

Also, a few nit picks/typos :

Section 3:

*the Extended Key Usage extension be present and that a
id-kp-documentSigning be indicated *

 ‘the’ instead of ‘a’

Section 4 -> Point 2
*'If there are restrictions set for the replying party*

'relying' instead of 'replying'

*Section 6 -> those who do not intend to set up an KeyPurposeId*

‘a’ or ‘any’ instead of ‘an’

Thanks,
Prachi

On Mon, Mar 7, 2022 at 3:54 PM Russ Housley <[email-masked]> wrote:

> Datatracker:
> https://datatracker.ietf.org/doc/draft-ietf-lamps-documentsigning-eku
>
> This document will assign a new extended key purpose identifier for
> document signing.  The WG Last Call will run until Tuesday, March 29th.
> This is a little longer than normal because of IETF 113.  Please review the
> document and respond with any comments or concerns on the mail list.
>
> For the LAMPS WG Chairs,
> Russ
>
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm
>

---

From: Tadahiko Ito <[email-masked]>
Date: Wed, 9 Mar 2022 06:20:37 +0900

Thanks Prachi

>> Also, a few nit picks/typos :
We will fix them alongside with the other comments (if any) we receive
during this WGLC.

>> One feedback which I have and believe will be very helpful to add is
'criticality'.
We are not defining a new extension, and Criticality of extension have
defined with EKU extension,
so I think following change can be applied.
I do not have strong feeling in the wording here,
so I will fix it unless there are someone who disagree that wording.

OLD:

The EKU extension syntax is repeated here for convenience:
     ExtKeyUsageSyntax  ::=  SEQUENCE SIZE (1..MAX) OF KeyPurposeId
     KeyPurposeId  ::=  OBJECT IDENTIFIER

NEW:

The EKU extension syntax is repeated here for convenience:
     ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
     KeyPurposeId ::= OBJECT IDENTIFIER
As descrived in {{RFC5280}}, EKU extension MAY,
at the option of the certificate issuer, be either critical or non-critical.

Regards Tadahiko Ito

---

From: Prachi Jain <[email-masked]>
Date: Tue, 8 Mar 2022 15:26:18 -0600

Thanks Tadahiko. Sounds good to me !!
Appreciate the quick reply 🙂

On Tue, Mar 8, 2022 at 3:20 PM Tadahiko Ito <[email-masked]>
wrote:

>> First of all, I want to say that this document is very well written,
>> clear and succinct. Congratulations on that !!
>>

---

From: Sean Turner <[email-masked]>
Date: Fri, 25 Mar 2022 08:28:17 -0400

> On Mar 8, 2022, at 16:20, Tadahiko Ito <[email-masked]> wrote:
> 
> Thanks Prachi
> 
> We will fix them alongside with the other comments (if any) we receive during this WGLC.
> 
> >> One feedback which I have and believe will be very helpful to add is 'criticality'. 
> We are not defining a new extension, and Criticality of extension have defined with EKU extension,

This is exactly what we talked about the session today. I would note that since we are duplicating the requirement, I think, we should probably not capitalize the MAY. In other words:

As described in {{RFC5280}}, EKU extension may, 
at the option of the certificate issuer, be either critical or non-critical.

spt

> First of all, I want to say that this document is very well written, clear and succinct. Congratulations on that !!
> 
> One feedback which I have and believe will be very helpful to add is 'criticality'. The document does not mention anything about marking/not-marking this extension as 'critical'. 
> 
> the Extended Key Usage extension be present and that a id-kp-documentSigning be indicated 
>  ‘the’ instead of ‘a’
> 
> Section 4 -> Point 2  
> 'If there are restrictions set for the replying party
> Section 6 -> those who do not intend to set up an KeyPurposeId

---

From: Russ Housley <[email-masked]>
Date: Tue, 29 Mar 2022 14:59:38 -0400

There were several comments, and they were all editorial.

Authors, please post an updated draft to resolve those comments.

Once that update is posted, I'll put together the shepherd write-up and send the document to the IESG for review, evaluation, and publication.

Russ

> On Mar 7, 2022, at 4:54 PM, Russ Housley <[email-masked]> wrote:
>