Re: [Anima] [Netconf] Cross-WGs WGLC (second) on draft-ietf-anima-voucher-04 - Respond by Aug 08, 2017

[Kent Watsen <[e-mail]>]

Hi Peter,

Thanks for your review.   Please find responses
to your comments below.

Max, please note your attention is needed.

Thanks,
Kent


--

Hi all,

I read this document, and find it well written and understandable.
I do have some remarks about the content and several editing remarks.

Content remarks:

section 6, leaf prior-signed-voucher, at the end:
The MASA SHOULD remove all "prior-signed-voucher".
I would encourage a "MUST" instead of a "SHOULD" when thinking of 
transporting vouchers over constrained networks.

<Kent> this leaf has been moved to the BRSKI draft, so this comment
is no longer an issue on this draft.


section 6.3: leaf idevid-issuer, description, paragraph 2,
 "populated for serial numbers that are not otherwise unique"
to be replaced by
 "populated when serial numbers are not unique".
My proposed text is less selective, and consequently less error prone.

<Kent> Fine, text updated.


> Can a discussion section about "manufacturer additions" be
> added. Pointing out the consequences for interoperability
> when using "Augment" to add manufacturer specifics can be
> helpful.

I'm confused, which section does this comment regard?


Editing remarks:

Introduction, first phrase: pledge -> candidate device (pledge)

<KENT> done.


page 3, PKCS#7 add RFC2315 reference, and may be add RFC7154 as JSON 
reference.

<KENT> done.


Section 2; mention terminology from RFC7950

<KENT> What is this?  Are you asking for the draft to import terms
from RFC7950?  Which terms 


page 4 line 5; "process. i Typically" remove the "i"

<KENT> fixed.


page 4, Voucher: add: that "acknowledges ownership of the pledge and" 
indicates...

<KENT> what does "acknowledges ownership of the pledge" mean?  how
is it different than "indicates to a Pledge the cryptographic identity
of the Domain it should trust"?


page 5 Authentication of: First appearances of PKIX, DNS-ID, and CN-ID 
abbreviations.

<KENT> I added a definition for PKIX, but I think that Max needs to take
care of the DNS-ID and CN-ID parts.  It's his text, and there things have
since been removed from the YANG.  Max, these show up in three places...


page 5, add (MiTM) after Man-in-The-Middle.

<KENT> added.


page 6 table: Voucher name -> Voucher type

<KENT> changed.


Nonceless Audit Voucher: "to support network partitions" -> "to 
withstand network partitions"

<KENT> changed.


Owenership audit Voucher: "Voucher's" -> "Vouchers", and remove "an 
ideal" otherwise explain what that means and why it is true.

<KENT> I'll leave this for Max.


> Add type in:
> Ownership ID voucher "type" is named
> Bearer Voucher "type" is named

<KENT> you only mention these two, but none of the voucher type 
descriptions have "type" in them, or maybe I'm missing something.


> section 6
> "The voucher is signing structure that" -> "The voucher signing 
> structure"

<KENT> done.


section 6, paragraph 6, all "of" the certificate, remove "of"

<KENT> done.


section 6 page 7 below, First appearance of CA and JWS abbreviations

<KENT> acronym expansions introduced.


section 6.1 (see section 4) add "see"

<KENT> done.


section 6.3 page 10, module description: "securely assign one or more 
pledges to an 'owner'" seems to contradict section 7.2 voucher per 
pledge

<KENT> correct, fixed.


> section 7.1 last line: "there is a delay" is that delay between creation 
> and consumption and when is the delay unacceptable? the text is (on 
> purpose?) vague.

<KENT> The previous sentence says "...there may be a significant
delay between when a voucher is created and when it is consumed."
and the remainder of the line you're citing says "to ensure that
the assertions made when the voucher was created are still valid 
when it is consumed."   This is vague?


section 8.1 first paragraph: "no understandING of time", add "ing"

<KENT> done.


section 8.1 paragraph 2: ephermal -> ephemeral

<KENT> fixed.

section 8.2 compromized -> compromised?

<KENT> fixed.