Re: [Acme] I-D Action: draft-ietf-acme-ari-03.txt

[Aaron Gable <[e-mail]>]

On Mon, Feb 26, 2024 at 4:36 AM Carl Wallace <[e-mail]>
wrote:

> Two comments on the third paragraph of section 4.1:
>
> - The addition of section identifiers for the references makes the
> sentences harder to read. Maybe wrapping the section identifiers and
> reference in parentheses.
>

Thanks, this feedback is appreciated. I've gone back and forth a lot on how
best to do these references, and tried a bunch of different things, and
this was my favorite phrasing so far. Unfortunately putting them in
parentheses causes the resulting sentence to not read in plain English,
unless I'm misunderstanding your suggestion?


> - The preparation of the URI uses the keyIdentifier field of
> AuthorityKeyIdentifier. That field is optional. What should occur if it is
> absent (or if AKID is absent)? Given 5280 requires uniqueness for issuer
> name and serial and the issuer field is not optional, would the issuer
> field make for a better target than AKID? If this mechanism only applies to
> certs that conform to a profile that requires presence of key identifier in
> the AKID extension, state that up front.
>

This is a very interesting point. RFC 5280 requires both that the AKID
extension be present and that the keyIdentifier field be present
within it (Section
4.2.1.1 <https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1>:
"The keyIdentifier field of the authorityKeyIdentifier extension MUST be
included in all certificates generated by conforming CAs to facilitate
certification path construction."). So it's not obvious to me that the
issuer name + serial uniqueness is any *more* required than the existence
of the keyIdentifier field. Do other members of this list think that using
some form of the Issuer Name bytes would be better than using the
keyIdentifier?

Thanks again,
Aaron