Subject: [sidr] Working Group Last Call - draft-ietf-sidr-cp-07.txt

From: Geoff Huston <[email-masked]>
Date: Wed, 28 Oct 2009 13:43:38 +1100

The WG chairs have received a Working Group Last Call request from the  
authors of draft-ietf-sidr-cp-07.txt.

The document (and the draft history) is at http://tools.ietf.org/html/draft-ietf-sidr-cp-07.txt

The Last Call will end as of the close of business on Monday 23rd  
November - this is a longer period than a conventional 2 week last  
call period in order to include the forthcoming SIDR WG meeting at  
IETF 76.

As usual, please address all comments to the WG mailing list, and  
please be clear in your comments to this last call if you are  
supporting the document's submission to the IESG or if you are  
opposed, or if you are not expressing a view either way.

thanks

    Geoff

   WG Co-CHair hat ON

---

From: Geoff Huston <[email-masked]>
Date: Thu, 29 Oct 2009 06:19:36 +1100

On 28/10/2009, at 1:43 PM, Geoff Huston wrote:

> The WG chairs have received a Working Group Last Call request from  
> the authors of draft-ietf-sidr-cp-07.txt.
>

Please note that that the draft's authors have advised me that the  
intended form of publication of this draft as a BCP.

regards,

    Geoff

    WG C0-Chait hat ON

---

From: Terry Manderson <[email-masked]>
Date: Wed, 28 Oct 2009 20:52:56 -0700

Oppose.

Although opposition is based on a small number of nits:

* Section 1.7, page 11. "RPKI signed Object" ... "declared to be such by a
standards track RFC issued by the SIDR WG"

Over time, the SIDR WG may not exist, or the name could change, or valid
RPKI objects come from other WG's. Perhaps 'issued by the IETF'

* Section 3.1.1 Types of names.

I think the section should it clear that names for the top level are
meaningless as covered in sidr-arch. It touches briefly on this in 3.1.3
"(and Issuer)" but appears in my reading to be ambiguous.

Perhaps " Names for IANA and RIRs will be meaningless directory
distinguished ....."

* Section 4.6.1-3 I'd like it made clear that renewal be only to the same
subscriber. eg the subscriber before and after renewal is the same. At
present it says that only the valid subscriber may request renewal, but
allows a new private key. I think there is too much wriggle room in that for
a subscriber to renew with someone else's private key.

* Sections 9.12.1, 9.12.2, 9.12.3.. If the CP is administered by the IESG
(section 1.6.1) shouldn't that also be reflected here?

Cheers
Terry

On 28/10/09 12:43 PM, "Geoff Huston" <[email-masked]> wrote:

> The document (and the draft history) is at
> http://tools.ietf.org/html/draft-ietf-sidr-cp-07.txt
> 
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr

---

From: Stephen Kent <[email-masked]>
Date: Fri, 30 Oct 2009 16:45:45 -0400

>RPKI objects come from other WG's. Perhaps 'issued by the IETF'

Good point re the longevity of SIDR, but we need to be careful to not 
allow arbitrary definition of such objects.

>Perhaps " Names for IANA and RIRs will be meaningless directory

We can add some more text to make such this is unambiguous.

>a subscriber to renew with someone else's private key.

The term "renewal" in the PKI space always means that the same 
subject is represented. the text in 3.2.1 mandates use of "proof of 
possession" mechanism for cert issuance, so it cannot be someone 
else's private key. we can say the same thing for renewal to ensure 
that this is not ambiguous.

>(section 1.6.1) shouldn't that also be reflected here?

yes, those sections should have been updated as well.  That was an oversight.

Steve

---

From: Randy Bush <[email-masked]>
Date: Sat, 31 Oct 2009 10:24:28 +0900

> We can add some more text to make such this is unambiguous.

we are consciously not proscribing 'meaningful' names for other IRs?

randy