Subject: [TLS] comments on draft-subcerts

From: "Salz, Rich" <[email-masked]>
Date: Tue, 14 Jul 2020 17:42:20 +0000

In no particular order. Mostly nits.

Sec 3.2, I understand the concern of ACME being a third-party dependency, while the origin is not really.  Perhaps a sentence of explanation why it is, would help.  Or maybe just say “with an ACME server”  And then mention ACME in the origin?

Sec 4, the “valid_time” says MUST NOT exceed seven days.  That’s relative to client and server concept of “now,” right?  See note below.

Sec 4.1.1 should say that SignatureSchemeList is the same as the one in RFC 8446.  I’d prefer to see the duplication removed.

Sec 4.2 doesn’t seem to agree with the complete ASN1 in Appendix A.  The latter has DelegatedCredentialExtn which is mentioned in prose and a TBD in 4.2  Perhaps a comment or some other words to tie them together?  Or does that issue just go away when IANA does the registration?

Sec 7.5, I would put the incognito mode in a separate paragraph to call it out more clearly.

Note below:
It could be possible for the server to pre-generate delegated credentials and either hold them or distribute them. I think that is worth mentioning, with the caveat that they cannot be used until within seven days of “now”

Tnx.

                /r$

---

From: Russ Housley <[email-masked]>
Date: Tue, 14 Jul 2020 14:51:11 -0400

> Sec 4.2 doesn’t seem to agree with the complete ASN1 in Appendix A.  The latter has DelegatedCredentialExtn which is mentioned in prose and a TBD in 4.2  Perhaps a comment or some other words to ti…

I do not see a problem.  

DelegatedCredentialExtn is the name of the module, and the OID that goes with it will be assigned by IANA in the future.

id-ce-delegationUsage is the OID that defines the X.909 certificate extension.  in Section 4.2 and Appendix A, this is assigned under the Cloudflare PEN arc as { 1 3 6 1 4 1 44363 44 }.

Russ