Subject: [sidr] #9: TA nits

From: "sidr issue tracker" <[email-masked]>
Date: Wed, 11 Nov 2009 11:49:35 -0000

#9: TA nits
--------------------------------+-------------------------------------------
 Reporter:  gih@…               |       Owner:     
     Type:  defect              |      Status:  new
 Priority:  medium              |   Milestone:     
Component:  ta                  |     Version:     
 Severity:  Active WG Document  |    Keywords:     
--------------------------------+-------------------------------------------
 Reported by Roque Gagliano

 2.1.  A Compound Trust Anchor Structure

          The ETA issues a CRL and one EE certificate.

 (Roque) I believe it needs to be explained that more than one ETA EE cert
 may be issued during the life-time of the ETA CA however at any particular
 moment there is only one valid EE cert.

 4.2.  RPKI Trust Anchor Object Validation

   2.  Use the public key in the EE certificate to verify the
           signature on the RTA Trust Anchor Object.

 (Roque) s/EE certificate/ETA EE certificate

       *  Each time an RTA certificate is re-issued, or prior to the
          expiration of the ETA EE certificate, the ETA generates a
          Cryptographic Message Syntax (CMS) [RFC3852] signed-data
          object, the payload of which is an RTA certificate.

 (Roque) If the ETA EE cert validity period is identical to the RTA
 validity period as stated in a previous bullet, the second condition
 ("prior to the expiration of the ETA EE certificate") would be the same as
 in the following section:
 "If a trust anchor chooses to reissue its RTA certificate before the
 expiration of that certificate."

 5.  Relying Party use of Trust Anchor Material

       *  The ETA's CRL and CMS objects are retrieved from the
          publication point referenced by the SIA in the ETA certificate.
 (Roque) s/CMS objects/CMS object

   Relying Parties SHOULD perform this retrieval and validation
    operation at intervals no less frequent than the nextUpdate time of
    the published ETA CRL, and SHOULD perform the retrieval operation
    prior to the expiration of the ETA EE certificate, or upon revocation
    of the ETA EE certificate.

 (Roque) If the retrieval operation is for both the CRL and the CMS, I do
 not understand the last sentence because the RP is not aware of the
 revocation until it has retrieve the CRL and in at that time it already
 has the new CMS. So, I would:
         s/, or upon revocation of the ETA EE certificate//

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/sidr/trac/ticket/9>
sidr <http://tools.ietf.org/sidr/>