Subject: [sidr] Working Group Last Call on draft-ietf-sidr-cp-08

From: Sandra Murphy <[email-masked]>
Date: Fri, 5 Mar 2010 17:05:46 -0500 (Eastern Standard Time)

The authors of Certificate Policy (CP) for the Resource PKI (RPKI) have 
submitted a new version in accordance with comments received in the last 
call (http://tools.ietf.org/html/draft-ietf-sidr-cp-08).

I am opening a last call on this document for one week, ending Friday, 
March 12.

Note that comments on this revision are restricted to whether the issues 
have been adequately addressed.

--Sandy

---

From: Sean Turner <[email-masked]>
Date: Fri, 05 Mar 2010 18:18:44 -0500

Is there only one RFC 2119 keyword in the ID on purpose (one "MUST" in 
section 2.3).

spt

Sandra Murphy wrote:
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr
>

---

From: Geoff Huston <[email-masked]>
Date: Tue, 9 Mar 2010 12:17:19 +1100

I do not believe that this document is ready for submission to the IESG. Some issues still remain with this document, as listed below.

Geoff

On 06/03/2010, at 9:05 AM, Sandra Murphy wrote:

> The authors of Certificate Policy (CP) for the Resource PKI (RPKI) have submitted a new version in accordance with comments received in the last call (http://tools.ietf.org/html/draft-ietf-sidr-cp-08).
> 
> I am opening a last call on this document for one week, ending Friday, March 12.
> 
> Note that comments on this revision are restricted to whether the issues have been adequately addressed.
> 

1. Introduction, para 1 - is the use of the verb "will" normative (i.e. MUST), or intentional "SHOULD" or optional" "MAY". I'd like to see the second sentence changed to say "MAY" or if that is not acceptable, to say "may"

2. Introduction, para 1 - third sentence - is this "will" more accurately a "can"

3. Introduction, para1, third sentence - "uniqueness" is not an outcome of verification of a certificate. It would be more accurate to drop "uniqueness" from this assertion.

4. section 1.2, para 1. The same assertion is made that associated certification with uniqueness. The constraint on an address issuer that creates a unique distribution of resources is not an intrinsic attribute of certification of the issuance.

5. section 1.4.1 - the document appears to preclude the actions of LIRs / ISPS in distributing AS numbers. I do not believe that this is appropriate, nor accurate, in today's environment

6. section 2.2 - is a CA responsible for publishing ALL certifications it issues, or can it be selective in publication? The section is unclear on this

7. section 2.2 - a similar question is raised regarding CRLs and RPKI-signed objects. Is the CA requires to publish ALL such issued objects?

8 section 2.3 - the document does not specify a CA's actions regarding the publication of expired and revoked certifications, nor indicate of the CA's CPS should include such information.

9. section 2.4 - is the "shall" here a "SHALL" in a normative sense or a "MAY"?

10. section 3.2.1 - is this "will require" a MUST require or a SHOULD require?

11. section 3.2.2 - is this "will" a MUST, SHOULD or a MAY?

12. section 3.2.3 - is this "will" a MUST, SHOULD or a MAY?

13. section 3.2.5 - is this "will" a MUST, SHOULD or a MAY? - This occurs in subsequent sections that describe actions of the CA, and the use of normative language in describing these CA actions is recommended. These instances are not further flagged here,.

14. sections 3.2 and 3.2 - I am not sure that these need to be separate - for example is issuance after revocation any different from initial issuance - i.e. the same criteria of 3.2.1, 3.2.2, 3.2.3 and 3.2.5 apply, so why is 3.3.2 called out - what new information is being provided here that is not already provided in the previous section?

15. section 3.4 - why does this section of the text NOT refer to the actions of a CA as described in sections 3.2.1, 3.2.2, 3.2.3 and 3.2.5? It appears that revocation is described in more informal terms and issuance, yet the constraints on the CA to ensure that authenticity of the request are intended to be the same.

16. section 4.1.1 - normative language required - the "should" referred to here is unclear. Subsequent sections also use "should" where normative language would be clearer.

17. section 4.5.2 - this section refers to "all the CAs in the chain that issued the certificates relevant to the certificate in question" without further clarification or explanation. In the light of related work on local TA generation I am left with the question of what exactly is being referred to here in this "chain"./ I would prefer this term to be defined.

18. section 4.8 - why is the treatment of augmentation of a subject's INRs treated differently to  reduction in a subject's INRs? While section 4.8 deals with the steps involved in issuing a new certification in the case where a subject's INR's are augmented, there is no corresponding description of the process in reduction, other that the single sentence in section 4.8.1 that does not refer to any other part of the CPS.

19 section 4.10 - is it truye to say that "This PKI does not make use of OCSP or SCVP" or is it more appropriate to state that "RPs SHOULD NOT rely on the use of OCSP or SCVP"?

20 - section 5.8 "The termination of a CA shall therefore be subject to the agreement between the issuer and the subscriber and will be described in the CPS for the issuer." I am finding it difficult to reconcile this need for "an agreement" in the light of the observation that where a CA no longer has any INR resources then it cannot function as a CA in the RPKI, whether or not an agreement is reached, Why then is an agreement stipulated here?

Style comment:

Is the use of double ' chars instead of a " or ' char deliberate? For example, I would've expected to see " marks in section 1.3 when describing the name of the document, and thereafter when denoting the use of particular terms.

---

From: Karen Seo <[email-masked]>
Date: Mon, 8 Mar 2010 22:58:59 -0500

Hi, Sean,

>Is there only one RFC 2119 keyword in the ID on purpose (one "MUST" 
>in section 2.3).

No, my oversight.  I was under the impression that the draft needed 
only the changes that were brought up in the previous WG Last Call 
and at IETF 76 and consequently didn't do a more global 
review/editorial pass.  So while the current wording reflects the 
past year's feedback (and maybe folks' desire to be diplomatic), I 
should have replaced a number of "will"s, "may"s, etc. with RFC 2119 
keywords.

Thank you,
Karen

---

From: Geoff Huston <[email-masked]>
Date: Wed, 10 Mar 2010 07:00:06 +1100

[I have been informed that my note I posted yesterday in response to the Last Call did not get circulated on the SIDR mailing list - I'll try once more - Geoff]

Geoff

Style comment:

---

From: Sandra Murphy <[email-masked]>
Date: Tue, 9 Mar 2010 15:13:22 -0500 (Eastern Standard Time)

If the "have been informed" was my message today, I was talking about the 
message you posted Nov 30, the one I attached to my message, in which you 
said that the authors should address the comments received, pointed to the 
issue tracker, etc, for the sidr-cp-07 version.

--Sandy

---

From: Geoff Huston <[email-masked]>
Date: Wed, 10 Mar 2010 08:17:54 +1100

My confusion - sorry for the dup posting.

On 10/03/2010, at 7:13 AM, Sandra Murphy wrote:

> If the "have been informed" was my message today, I was talking about the message you posted Nov 30, the one I attached to my message, in which you said that the authors should address the comments received, pointed to the issue tracker, etc, for the sidr-cp-07 version.
> 
> --Sandy
>

---

From: Sandra Murphy <[email-masked]>
Date: Sat, 13 Mar 2010 07:37:14 -0500 (Eastern Standard Time)

It having passed Mar 12 AOE, the last call has ended.

Geoff Houston and Sean Turner both commented on the draft.  I thank them 
both for their comments.  The comments had enough weight that I can not 
declare consensus to request publication of the draft at this time.

I ask the authors to consider these comments and to produce a new version 
of the draft.

--Sandy

On Fri, 5 Mar 2010, Sandra Murphy wrote:

> submitted a new version in accordance with comments received in the last call 
> (http://tools.ietf.org/html/draft-ietf-sidr-cp-08).
>