Subject: Re: [sidr] #3: Nit Report - CP draft

From: "sidr issue tracker" <[email-masked]>
Date: Wed, 11 Nov 2009 12:00:50 -0000

#3: Nit Report - CP draft
-----------------------------+----------------------------------------------
 Reporter:  gih@…            |       Owner:     
     Type:  task             |      Status:  new
 Priority:  minor            |   Milestone:     
Component:  cp               |     Version:     
 Severity:  In WG Last Call  |    Keywords:     
-----------------------------+----------------------------------------------

Comment(by gih@…):

 Steve Kent (5/11)

 IN a message on 10/28 you said:

 * Section 4.6.1-3 I'd like it made clear that renewal be only to the same
 subscriber. eg the subscriber before and after renewal is the same. At
 present it says that only the valid subscriber may request renewal, but
 allows a new private key. I think there is too much wriggle room in that
 for
 a subscriber to renew with someone else's private key.

 I reviewed the CP text and I think this is clear.

 Specifically 4.6.2 says:  "Only the certificate holder or the issuing CA
 may initiate the renewal process."

 And 4.6.3 says: "Renewal procedures must ensure that the person or
 organization
 seeking to renew a certificate is in fact the subscriber (or authorized by
 the subscriber) of the certificate and the legitimate holder of the INR
 associated with the renewed certificate."

 I think these two text sections already address the issue you raised.

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/sidr/trac/ticket/3#comment:1>
sidr <http://tools.ietf.org/sidr/>

---

From: "sidr issue tracker" <[email-masked]>
Date: Thu, 12 Nov 2009 11:28:36 -0000

Comment(by gih@…):

 Proposed changes: Steve Kent 5/11

 Changed status to be Best Current Practice from Informational (consistent
 with eventual BCP designation)

 In Section 1.7 revised text (removed references to SIDR WG)

 RPKI signed object - Digitally signed data object (other than a
 certificate or CRL) declared to be such by a standards track RFC,
 and that can be validated using certificates issued under this PKI.

 ------

 Section 1.4.4 revised text (removed references to SIDR WG)

 An RPKI signed object is a digitally-signed object, declared to be such by
 a standards track RFC.

 -------

 Section 9.12.1 revised text (removed reference to RIRs and IANA, replaced
 with IETF)

 The procedure for amending this CP is via written notice from the IETF in
 the form of a new Standards Track, BCP RFC that updates or obsoletes this
 document.

 ------

 Sectioon 9.12.2 revised text (removed reference to RIRs and IANA, replaced
 with IETF)

 The IETF will provide at least one month's advance notice of any changes
 to this CP.
 -------

 Section 9.12.3 revised text (removed reference to RIRs and IANA, replaced
 with IETF)

 If the IETF judges that changes to the CP do not materially reduce the
 acceptability of certificates issued for RPKI purposes, there will be no
 change to the CP OID. If the IETF judges that changes to the CP do
 materially change the the acceptability of certificates for RPKI purposes,
 then there will be a new CP OID.

 Section 13.2 (removed last two informative references)

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/sidr/trac/ticket/3#comment:2>
sidr <http://tools.ietf.org/sidr/>