Re: [Acme] AD Review of draft-ietf-acme-email-smime-07

[Alexey Melnikov <[e-mail]>]

Hi Roman,

On 22/05/2020 15:54, Roman Danyliw wrote:
> ** Section 6.
>
> -- Recommend explicitly naming the registries being updated
> -- Per the challenge type, all of the fields in the registry aren't described here
> -- Per the challenge type, the text in Section 3 says that the challenge type is "email-reply-00" (not "email-reply" as described here)
>
> I recommend something like the following:
> NEW:
> 6.1.  Identifier Type
>
> Per this document, a new type has been added to the "ACME Identifier Types" registry defined in Section 9.7.7 of [RFC8555] with Label "email" and a Reference to this document.
>
> 6.2.  Challenge Types
>
> Per this document, a new entry have been added to the "ACME Validation Methods" registry defined in Section 9.7.8 of [RFC8555].  This entry is as follows:
>
>             +-------------+-----------------+------+-----------+
>             | Label       | Identifier Type | ACME | Reference |
>             +=============+=================+======+===========+
>             | email-reply-00 | email              | Y    | This document  |
>             +-------------+-----------------+------+-----------+
Thank you for this. I've used some of your suggested text and kept some 
of mine, where I think it was important.
> ** Section 7.  Per "Any claims about the correctness or    fitness-for-purpose of the email address must be otherwise assured", I don't follow the intent of this text.  For example, what is the "correctness ... of the email address"?  What is meant by "assurances"?

This was based on feedback from one of reviewers. It is basically saying 
that issued ACME certificates don't vouch for anything other than "this 
email seems to belong to the entity that requested it". Does this make 
sense?

Best Regards,

Alexey