Re: [apps-discuss] Apps-team review: draft-ietf-sipcore-sec-flows

[Brian Hibbard <[e-mail]>]

Hello Kurt,

Thank you for your input.   The inconsistencies in presentation of DN that you're talking about are the actual results of the dumps of the OpenSSL "x509" certificate tool.  The use of the tool in this context is only to examine the content of the certificates for learning and testing purposes, and in the draft, to show what  designers and testers would see in their environments.   It is only because those are the actual results from the tool most likely to be used by readers of this document, that we are partial to leaving the dumps as they are.  

With that said, if you remain convinced that consistency  of presentation is the more important factor here, I will go and make changes to the x509 dumps.

Regards,
Brian

On Dec 15, 2010, at 9:21 AM, Kurt Zeilenga wrote:

> I have been selected as the Applications Area Review Team reviewer for this draft (for background on apps-review, please seehttp://www.apps.ietf.org/content/applications-area-review-team).
> 
> Please resolve these comments along with any other Last Call comments you may receive. Please wait for direction from your document shepherd or AD before posting a new version of the draft.
> 
> Document: draft-ietf-sipcore-sec-flows (rev-07 reviewed)
> Title: Example call flows using Session Initiation Protocol (SIP) security mechanisms
> Reviewer: Kurt Zeilenga
> Review Date: 12/15/2010
> IETF Last Call Date: [include if known]
> IESG Telechat Date: 2011-01-20
> Summary: This draft is basically ready for publication as an Informational RFC but has a few issues that should be fixed before publication.
> Major Issues: None.
> Minor Issues: 
> 
> I see some inconsistencies in how Distinguished Names (DNs) are presented in the RFC.
> 
> For instance (from 2.1):
>   Issuer: C=US, ST=California, L=San Jose, O=sipit,
>           OU=Sipit Test Certificate Authority
> 
> vs. (also from 2.1)
>   DirName:/C=US/ST=California/L=San Jose/O=sipit/
>           OU=Sipit Test Certificate Authority
> 
> The former kind of looks like the LDAP DN format but, if that's what was intended, the RDNs appear in the incorrect order.  Note that in the LDAP DN format, the most specific element appears first (the reverse of how they appear in the BER/DER encoding of a DN).  Also, there should be no spaces after the RDN separators (the commas).
> 
> The latter appears to be DCE format.
> 
> I would think it appropriate to use a single format for all DNs and, if one chooses to use the LDAP DN format, that values ought to be constructed per RFC 4514.  I note that Appendix A of RFC 4514 discusses presentation issues of Distinguished Names.
> 
> Nits: The usual (many acronyms are not spelled out on first use, etc.)