[Acme] Re: AD comments on draft-ietf-acme-device-attest

[Mike Ounsworth <[e-mail]>]

@Deb Cooley <[e-mail]>

FYI the authors just published -04 a few minutes ago, which addresses all
the IESG comments received so far.
https://datatracker.ietf.org/doc/draft-ietf-acme-device-attest/


On Tue, 5 May 2026 at 17:00, Ganesh Mallaya <ganesh.mallaya=
[e-mail]> wrote:

> Hello Deb,
>
> Thank you for the note and the comments, all points noted, yes we will
> review and work through them along the IETF LC.
>
> Get Outlook for iOS <https://aka.ms/o0ukef>
> ------------------------------
> *From:* Deb Cooley <[e-mail]>
> *Sent:* Monday, May 4, 2026 04:22
> *To:* [e-mail] <
> [e-mail]>
> *Cc:* <[e-mail]> <[e-mail]>; IETF ACME <
> [e-mail]>
> *Subject:* AD comments on draft-ietf-acme-device-attest
>
> *CAUTION: *This email originated from outside of the organization. Do not
> click links or open attachments unless you can confirm the sender and know
> the content is safe.
>
> First-time / External Recipient Warning
> You have not previously corresponded with this sender.
>
> Thanks for the work to improve this draft!
>
> I have several pretty easy comments.  I will put this draft into IETF Last
> Call, with the assumption that my comments will be worked before/together
> with IETF Last Call comments.
>
> Section 1, para 3:  'is to be' is an odd turn of phrase, how about 'will
> be'?
>
> Section 3.1, assigner value:  Is this intended to be an IP address?  If
> so, expect to get a comment similar to 'what about IPv6 addresses?'  If it
> is intended to be an OID, then I would just say that, as is done in Section
> 4.1.
>
> Section 3.2, title:  Add (CSR).  Or within para 4, spell out CSR instead.
>
> Section 3.2 and 4.2, para 3 and 4:  'octet-for-octet', I'm curious to hear
> why any other sort of 'match' isn't correct or useful.  And why merely
> saying that it 'MUST be a match' wouldn't work.
>
> Section 6.1, para 1:  nit:  remove '###External Account Binding'.
>
> Section 6.1.1, para 2:   This wording isn't clear (I had to read it a
> bunch of times to understand).  How about something like, 'Servers can rely
> on other authorization mechanisms,such as external account binding or
> pre-authorized accounts, to establish device identity instead of completing
> the device-attest-01 challenge.'
>
> Deb Cooley
> Sec AD
> _______________________________________________
> Acme mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>