Subject: Re: [stir] [Gen-art] Genart last call review of draft-ietf-stir-certificates-15

From: Alissa Cooper <[email-masked]>
Date: Tue, 12 Dec 2017 14:47:12 -0500

Joel, thanks for your review. Sean, thanks for your response. I’m keeping my Yes ballot from the last time around. I don’t have a strong opinion about the trust anchor issue.

Best,
Alissa

> On Nov 17, 2017, at 1:56 AM, Joel Halpern <[email-masked]> wrote:
> 
> Reviewer: Joel Halpern
> Review result: Ready
> 
> I am the assigned Gen-ART reviewer for this draft. The General Area
> Review Team (Gen-ART) reviews all IETF documents being processed
> by the IESG for the IETF Chair.  Please treat these comments just
> like any other last call comments.
> 
> For more information, please see the FAQ at
> 
> <https://trac.ietf.org/trac/gen/wiki/GenArtfaq>.
> 
> Document: draft-ietf-stir-certificates-15
> Reviewer: Joel Halpern
> Review Date: 2017-11-16
> IETF LC End Date: 2017-11-30
> IESG Telechat date: 2017-12-14
> 
> Summary:
> 
> Major issues:
> 
> Minor issues:
>    Section 4 bullet 4 in naming the crypto algorithms refers quite clearly to
>    2 algorithms.  It then references one of them as RS256.  I assume those
>    versed in the field will know which one is meant.  But it would be better
>    if the abbreviation RS256 appeared next to the first reference to whichever
>    algorithm it means.
> 
>    The security considerations section points to RFC 5280 security
>    considerations for most issues.  I presume that the intention is to use
>    that section regarding trusting CAs.  However, it seems that there is an
>    issue here much like that of classic web CAs.  The number of CAs that must
>    be trusted seems to be on the order of the number of countries in the
>    world.  That seems to leave a large window for false or misleading
>    certifications, as I can see nothing which restricts what numbers for which
>    those top level CAs can provide attestation.  I presume we do not want to
>    go down the path of requiring an uber-CA for all national authorities.  I
>    would expect some explicit recognition of this issue in this document.
> 
> Nits/editorial comments:
> 
> 
> _______________________________________________
> Gen-art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/gen-art