Subject: [stir] I-D Action: draft-ietf-stir-certificates-04.txt

From: [email-masked]
Date: Thu, 26 May 2016 17:51:50 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Secure Telephone Identity Revisited of the IETF.

        Title           : Secure Telephone Identity Credentials: Certificates
        Authors         : Jon Peterson
                          Sean Turner
	Filename        : draft-ietf-stir-certificates-04.txt
	Pages           : 19
	Date            : 2016-05-26

Abstract:
   In order to prevent the impersonation of telephone numbers on the
   Internet, some kind of credential system needs to exist that
   cryptographically proves authority over telephone numbers.  This
   document describes the use of certificates in establishing authority
   over telephone numbers, as a component of a broader architecture for
   managing telephone numbers as identities in protocols like SIP.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-stir-certificates/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-stir-certificates-04

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-certificates-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Peterson, Jon" <[email-masked]>
Date: Fri, 27 May 2016 00:54:32 +0000

This is a small update of the stir-certs document, to reflect the
consensus on algorithms that has been forged on the list here, and also to
introduce a new "Certificate Usage" section that explicitly answers the
requirements in rfc4474bis Section 6.4.

Jon Peterson
Neustar, Inc.

On 5/26/16, 5:51 PM, "stir on behalf of [email-masked]"
<[email-masked] on behalf of [email-masked]> wrote:

>_______________________________________________
>stir mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/stir

---

From: Russ Housley <[email-masked]>
Date: Fri, 27 May 2016 10:29:53 -0400

Jon and Sean:

I do not think this document is ready for WG Last Call.

In Section 4, the 4th numbered paragraph: we are going to use SHA-256 as the one-way hash function in both cases.  Please say so.

In Section 4, the 5th numbered paragraph: we are going to use SHA-256 for the signature carried in PASSporT.  Please say so.

In Section 5, the last two paragraphs are marked [TBD].  What WG discussion is needed to resolve those?

In Section 8, you ask whether we want to use IA5String, but the alternative presented uses UTF8String.  Since the string can only contain digits, I think the bits on the wire would be the same except for the tag.  So, I recommend IA5String since it is easier to understand the SIZE calculation and string comparison for an ASCII strings.

In Section 9.2, there are two paragraphs are marked [TBD].  For the second one, we want to use SHA-256.  I assume that the OCSP responses can be signed with either of the algorithms that are supported for the certificates themselves.  What WG discussion is needed to resolve both of these TBDs?

In Section 9.2.1, what WG discussion is needed to resolve the “[More TBD]” in the 3rd paragraph?

The Appendix is missing the ASN.1 module.  That is pretty easy to draft.  Of course, the object identifiers will be TBD until IANA assigns them.

Russ