[auth48] Re: [AD] RFC-to-be 10004 draft-ietf-lamps-rfc5274bis for your review

[Sean Turner <[e-mail]>]

Oh and this:

1) Abstract:

OLD:

RFC 10002 and 10003

NEW:

RFCs 10002 and 10003

2) Abstract & Introduction

OLD:

CMC (Certificate Management over CMS) 

NEW:

Certificate Management over CMS (CMC) 

spt

> On Jun 1, 2026, at 13:03, Sean Turner <[e-mail]> wrote:
> 
> Just checking on this:
> 
> Section 4:
> 
> OLD:
> 
> Added RA Identity Proof Witness and Response Body controls to the CMC
>    Control Attributes table to Table 1.
> NEW:
> Added RA Identity Proof Witness and Response Body controls to Table 1.
> 
>> On May 29, 2026, at 13:25, Megan Ferguson <[e-mail]> wrote:
>> 
>> Hi Joe (and *AD),
>> 
>> Thanks for clarifying!
>> 
>> We’ve added the text to the current version of the files; please refresh to review.
>> 
>> Note that [HMAC-ALGS] (RFC 6268) was not previously referenced in this document.  We’ve added it as a normative reference (to match how it was used in RFC-to-be 10002).  Please let us know if that is incorrect.
>> 
>> *AD - Please review our update to add the above RFC as an entry in the Normative References section.
>> 
>> The files have been posted here (please refresh):
>> https://www.rfc-editor.org/authors/rfc10004.txt
>> https://www.rfc-editor.org/authors/rfc10004.pdf
>> https://www.rfc-editor.org/authors/rfc10004.html
>> https://www.rfc-editor.org/authors/rfc10004.xml
>> 
>> The diff files have been posted here (please refresh):
>> https://www.rfc-editor.org/authors/rfc10004-diff.html (comprehensive)
>> https://www.rfc-editor.org/authors/rfc10004-rfcdiff.html (side by side)
>> 
>> https://www.rfc-editor.org/authors/rfc10004-auth48diff.html (AUTH48 changes only)
>> https://www.rfc-editor.org/authors/rfc10004-auth48rfcdiff.html (side by side)
>> 
>> The Final Review status page exists here:
>> https://www.rfc-editor.org/auth48/rfc10004
>> 
>> Thank you.
>> 
>> Megan Ferguson
>> RFC Production Center
>> 
>> 
>>> On May 29, 2026, at 2:03 PM, Joe Mandel <[e-mail]> wrote:
>>> 
>>> Hi Megan, 
>>> 
>>> Apologies for the confusion. We’d like to have HMAC added to the terminology with the text provided:
>>> 
>>> HMAC refers to the Hashed Message Authentication Code. CMC uses the ASN.1 module defined in [HMAC-ALGS].
>>> 
>>> Joe
>>> 
>>>> On May 29, 2026, at 11:25 AM, Megan Ferguson <[e-mail]> wrote:
>>>> 
>>>> Hi Sean, Joe, and *AD,
>>>> 
>>>> —
>>>> *AD - please review and approve the updates to Table 1 (and point 3 that follows it) as these are updates to BCP 14 keywords.
>>>> —
>>>> 
>>>> Thank you for your replies and guidance.  We have updated the files as requested.
>>>> 
>>>> We had the same follow up as for RFC-to-be 10002: please confirm if HMAC should be added to the terminology list (was the text you sent intended to appear in the document or was it an explanation?).
>>>> 
>>>> Please review carefully as we do not make changes once the document is published as an RFC.
>>>> 
>>>> The files have been posted here (please refresh):
>>>> https://www.rfc-editor.org/authors/rfc10004.txt
>>>> https://www.rfc-editor.org/authors/rfc10004.pdf
>>>> https://www.rfc-editor.org/authors/rfc10004.html
>>>> https://www.rfc-editor.org/authors/rfc10004.xml
>>>> 
>>>> The diff files have been posted here (please refresh):
>>>> https://www.rfc-editor.org/authors/rfc10004-diff.html (comprehensive)
>>>> https://www.rfc-editor.org/authors/rfc10004-rfcdiff.html (side by side)
>>>> 
>>>> https://www.rfc-editor.org/authors/rfc10004-auth48diff.html (AUTH48 changes only)
>>>> https://www.rfc-editor.org/authors/rfc10004-auth48rfcdiff.html (side by side)
>>>> 
>>>> The Final Review status page exists here:
>>>> https://www.rfc-editor.org/auth48/rfc10004
>>>> 
>>>> Thank you.
>>>> 
>>>> Megan Ferguson
>>>> RFC Production Center
>>>> 
>>>> 
>>>>> On May 28, 2026, at 2:31 PM, Sean Turner <[e-mail]> wrote:
>>>>> 
>>>>> More nits:
>>>>> 
>>>>> 1) s4:
>>>>> 
>>>>> OLD:
>>>>> 
>>>>> Control Attributes table Table 1.
>>>>> 
>>>>> NEW:
>>>>> 
>>>>> Control Attributes to Table 1.
>>>>> 
>>>>> 2) s4 (before the for/with swap):
>>>>> 
>>>>> OLD:
>>>>> 
>>>>> Updated the Cryptographic Algorithm Requirements and added a section 
>>>>> to maintain backward compatibility.
>>>>> 
>>>>> *  Replaced SHA-1 for SHA-256
>>>>> *  Replaced HMAC-SHA-1 for HMAC-SHA-256
>>>>> 
>>>>> NEW (no bullets):
>>>>> 
>>>>> Updated the Cryptographic Algorithm Requirements:
>>>>> *  Replaced SHA-1 for SHA-256
>>>>> *  Replaced HMAC-SHA-1 for HMAC-SHA-256
>>>>> *  Added algorithms for AuthEnvelopedData
>>>>> 
>>>>> Added a paragraph to maintain backward algorithm compatibility.
>>>>> 
>>>>> 3) s4: Move last paragraph to be after Merged [CMC-Updates] text.
>>>>> 
>>>>> spt
>>>>> 
>>>>>> On May 28, 2026, at 13:34, Joe Mandel <[e-mail]> wrote:
>>>>>> 
>>>>>> Please see our responses below.
>>>>>> 
>>>>>> Joe and Sean
>>>>>> 
>>>>>>> On May 22, 2026, at 11:20 AM, [e-mail] wrote:
>>>>>>> 
>>>>>>> Authors,
>>>>>>> 
>>>>>>> While reviewing this document during AUTH48, please resolve (as necessary) 
>>>>>>> the following questions, which are also in the source file.
>>>>>>> 
>>>>>>> 1) <!--[rfced] We note that the title does not have a 1:1 match between
>>>>>>> abbreviation and expansion (as was seen in the companions
>>>>>>> documents).  May we update as follows to match?
>>>>>>> 
>>>>>>> Original:
>>>>>>> Certificate Management Messages over CMS (CMC): Compliance Requirements
>>>>>>> 
>>>>>>> Perhaps:
>>>>>>> Certificate Management over CMS (CMC) Messages: Compliance Requirements
>>>>>>> 
>>>>>>> or
>>>>>>> Certificate Management over CMS (CMC): Message Compliance Requirements
>>>>>>> 
>>>>>>> Other docs in cluster use:
>>>>>>> Certificate Management over CMS (CMC)
>>>>>>> Certificate Management over CMS (CMC): Transport Protocols
>>>>>>> -->
>>>>>> 
>>>>>> Please change to Certificate Management over CMS (CMC): Compliance Requirements
>>>>>>> 
>>>>>>> 
>>>>>>> 2) <!--[rfced] We had the following questions related to the Terminology
>>>>>>> section:
>>>>>>> 
>>>>>>> a) Perhaps the following might be added to the list in the Terminology
>>>>>>> section (as there isn't an easy way to expand on first use)?
>>>>>>> 
>>>>>>> HMAC: Hashed Message Authentication Code
>>>>>> To align with terminology in 10002:
>>>>>> 
>>>>>> HMAC refers to the Hashed Message Authentication Code. CMC uses the ASN.1 module defined in [HMAC-ALGS].
>>>>>>> 
>>>>>>> b) We note that the definition of POP in
>>>>>>> draft-ietf-lamps-rfc5272bis-11 includes the different types of POP.
>>>>>>> Should those be included in this document as well?  Or perhaps a
>>>>>>> pointer to draft-ietf-lamps-rfc5272bis-11?
>>>>>> 
>>>>>> Please add: (Section 2.1 of [CMC-STRUCT])
>>>>>>> 
>>>>>>> -->      
>>>>>>> 
>>>>>>> 
>>>>>>> 3) <!--[rfced] Is "for" correct here or should this be "with"?
>>>>>>> 
>>>>>>> Original:
>>>>>>> *  Replaced SHA-1 for SHA-256
>>>>>>> 
>>>>>>> *  Replaced HMAC-SHA-1 for HMAC-SHA-256
>>>>>>> 
>>>>>>> Perhaps:
>>>>>>> 
>>>>>>> *  Replaced SHA-1 with SHA-256
>>>>>>> 
>>>>>>> *  Replaced HMAC-SHA-1 with HMAC-SHA-256
>>>>>>> 
>>>>>>> -->
>>>>>> 
>>>>>> We agree, please change to “with”.
>>>>>>> 
>>>>>>> 
>>>>>>> 4) <!-- [rfced] Section 6.3.1 of [CMC-STRUCT] is titled "Cryptographic
>>>>>>> Linkage" while Section 6.3.1.1 is titled "POP Link Witness
>>>>>>> Version 2 Controls". Should this link point to Section 6.3.1 or
>>>>>>> 6.3.1.1?'
>>>>>>> 
>>>>>>> Current:
>>>>>>> Algorithm requirements for the Pop Link Witness Version 2 control
>>>>>>> (Section 6.3.1 of [CMC-STRUCT]) are: SHA-256 MUST be implemented for
>>>>>>> keyGenAlgorithm. PBKDF2 [PBKDF2] MAY be implemented for
>>>>>>> keyGenAlgorithm. HMAC-SHA256 MUST be implemented for macAlgorithm.
>>>>>>> 
>>>>>>>   -->
>>>>>> 
>>>>>> Please change to Section 6.3.1.1.
>>>>>>> 
>>>>>>> 
>>>>>>> 5) <!--[rfced] We had the following questions related to Table 1:
>>>>>>> 
>>>>>>> a) Note 4: should any updates be made to Note 4 to mention a third
>>>>>>> condition (the DH key certification in Section 8)?
>>>>>>> 
>>>>>>> Original:
>>>>>>> If an End-Entity implements Diffie-Hellman, it MUST implement either
>>>>>>> the DH-POP Proof-of-Possession as defined in Section 4 of [DH-POP] or
>>>>>>> the challenge-response POP controls id-cmc-encryptedPOP and
>>>>>>> id-cmc-decryptedPOP.
>>>>>> 
>>>>>> The way that we read this is there are only two options. We are open to feedback if others see it differently.
>>>>>>> 
>>>>>>> b) The table says RA: SHOULD for RA POP Witness
>>>>>>> (id-cmc-lraPOPWitness). But Section 9 says that RAs implementing
>>>>>>> delegated POP MUST implement id-cmc-lraPOPWitness.  Please review.
>>>>>> 
>>>>>> We think it is fine as is. Since this is conditional MUST. You should support the feature and if you do then it’s a MUST.
>>>>>>> 
>>>>>>> c) We note that the table uses lowercase "optional" while other
>>>>>>> entries in the table are BCP 14 keywords.  Please review if this is
>>>>>>> intentional and/or if any text to clarify should be added.
>>>>>>> -->
>>>>>> 
>>>>>> Please change to OPTIONAL. 
>>>>>> 
>>>>>> Also in Note 3 - “optional” is used but we should probably also make that “OPTIONAL”.
>>>>>>> 
>>>>>>> 
>>>>>>> 6) <!--[rfced] As this note appeared in RFC 5274, is this still true?  Or
>>>>>>> has development concluded?
>>>>>>> 
>>>>>>> Original:
>>>>>>> An alternative method is under development to provide
>>>>>>> this functionality.
>>>>>>> -->
>>>>>> 
>>>>>> We’d like to change this to say:
>>>>>> 
>>>>>> See (Section 3.2.1.3.3 and Section 3.2.1.3.3 of [CMC-STRUCT]) for alternative methods.
>>>>>>> 
>>>>>>> 
>>>>>>> 7) <!--[rfced] We had the following questions about terminology used
>>>>>>> throughout the document:
>>>>>>> 
>>>>>>> a) We have updated uses of Authenticate Data to be Authenticated Data
>>>>>>> to match the use in the other docs in the cluster.  Please let us know
>>>>>>> any objections.
>>>>>>> 
>>>>>>> -->
>>>>>> 
>>>>>> We agree.
>>>>>>> 
>>>>>>> 
>>>>>>> 8) <!-- [rfced] Please review the "Inclusive Language" portion of the online 
>>>>>>> Style Guide <https://www.rfc-editor.org/styleguide/part2/#inclusive_language>
>>>>>>> and let us know if any changes are needed.  Updates of this nature typically
>>>>>>> result in more precise language, which is helpful for readers.
>>>>>>> 
>>>>>>> Note that our script did not flag any words in particular, but this should 
>>>>>>> still be reviewed as a best practice.
>>>>>>> 
>>>>>>> -->
>>>>>> 
>>>>>> We reviewed.
>>>>>>> 
>>>>>>> 
>>>>>>> Thank you.
>>>>>>> 
>>>>>>> Megan Ferguson
>>>>>>> RFC Production Center
>>>>>>> 
>>>>>>> 
>>>>>>> *****IMPORTANT*****
>>>>>>> 
>>>>>>> RFC Author(s):
>>>>>>> --------------
>>>>>>> 
>>>>>>> Instructions for Completing AUTH48
>>>>>>> 
>>>>>>> Your document has now entered AUTH48.  Once it has been reviewed and
>>>>>>> approved by you and all coauthors, it will be published as an RFC.
>>>>>>> If an author is no longer available, there are several remedies
>>>>>>> available as listed in the FAQ (https://www.rfc-editor.org/faq/)
>>>>>>> 
>>>>>>> You and you coauthors are responsible for engaging other parties
>>>>>>> (e.g., Contributors or Working Group) as necessary before providing
>>>>>>> your approval.
>>>>>>> 
>>>>>>> Planning your review
>>>>>>> ---------------------
>>>>>>> 
>>>>>>> Please review the following aspects of your document:
>>>>>>> 
>>>>>>> *  RFC Editor questions
>>>>>>> 
>>>>>>> Please review and resolve any questions raised by the RFC Editor
>>>>>>> that have been included in the XML file as comments marked as
>>>>>>> follows:
>>>>>>> 
>>>>>>> <!-- [rfced] ... -->
>>>>>>> 
>>>>>>> These questions will also be sent in a subsequent email.
>>>>>>> 
>>>>>>> *  Changes submitted by coauthors
>>>>>>> 
>>>>>>> Please ensure that you review any changes submitted by your
>>>>>>> coauthors.  We assume that if you do not speak up that you
>>>>>>> agree to changes submitted by your coauthors.
>>>>>>> 
>>>>>>> *  Content
>>>>>>> 
>>>>>>> Please review the full content of the document, as this cannot
>>>>>>> change once the RFC is published.  Please pay particular attention to:
>>>>>>> - IANA considerations updates (if applicable)
>>>>>>> - contact information
>>>>>>> - references
>>>>>>> 
>>>>>>> *  Copyright notices and legends
>>>>>>> 
>>>>>>> Please review the copyright notice and legends as defined in
>>>>>>> RFC 5378 and the Trust Legal Provisions
>>>>>>> (TLP – https://trustee.ietf.org/license-info)
>>>>>>> 
>>>>>>> *  Semantic markup
>>>>>>> 
>>>>>>> Please review the markup in the XML file to ensure that elements of
>>>>>>> content are correctly tagged.  For example, ensure that <sourcecode>
>>>>>>> and <artwork> are set correctly.  See details at
>>>>>>> <https://authors.ietf.org/rfcxml-vocabulary>.
>>>>>>> 
>>>>>>> *  Formatted output
>>>>>>> 
>>>>>>> Please review the PDF, HTML, and TXT files to ensure that the
>>>>>>> formatted output, as generated from the markup in the XML file, is
>>>>>>> reasonable.  Please note that the TXT will have formatting
>>>>>>> limitations compared to the PDF and HTML.
>>>>>>> 
>>>>>>> 
>>>>>>> Submitting changes
>>>>>>> ------------------
>>>>>>> 
>>>>>>> To submit changes, please reply to this email using ‘REPLY ALL’ as all
>>>>>>> the parties CCed on this message need to see your changes. The parties
>>>>>>> include:
>>>>>>> 
>>>>>>> *  your coauthors
>>>>>>> 
>>>>>>> *  [e-mail] (the RPC team)
>>>>>>> 
>>>>>>> *  other document participants, depending on the stream (e.g.,
>>>>>>> IETF Stream participants are your working group chairs, the
>>>>>>> responsible ADs, and the document shepherd).
>>>>>>> 
>>>>>>> *  [e-mail], which is a new archival mailing list
>>>>>>> to preserve AUTH48 conversations; it is not an active discussion
>>>>>>> list:
>>>>>>> 
>>>>>>> *  More info:
>>>>>>>   https://mailarchive.ietf.org/arch/msg/ietf-announce/yb6lpIGh-4Q9l2USxIAe6P8O4Zc
>>>>>>> 
>>>>>>> *  The archive itself:
>>>>>>>   https://mailarchive.ietf.org/arch/browse/auth48archive/
>>>>>>> 
>>>>>>> *  Note: If only absolutely necessary, you may temporarily opt out
>>>>>>>   of the archiving of messages (e.g., to discuss a sensitive matter).
>>>>>>>   If needed, please add a note at the top of the message that you
>>>>>>>   have dropped the address. When the discussion is concluded,
>>>>>>>   [e-mail] will be re-added to the CC list and
>>>>>>>   its addition will be noted at the top of the message.
>>>>>>> 
>>>>>>> You may submit your changes in one of two ways:
>>>>>>> 
>>>>>>> An update to the provided XML file
>>>>>>> — OR —
>>>>>>> An explicit list of changes in this format
>>>>>>> 
>>>>>>> Section # (or indicate Global)
>>>>>>> 
>>>>>>> OLD:
>>>>>>> old text
>>>>>>> 
>>>>>>> NEW:
>>>>>>> new text
>>>>>>> 
>>>>>>> You do not need to reply with both an updated XML file and an explicit
>>>>>>> list of changes, as either form is sufficient.
>>>>>>> 
>>>>>>> We will ask a stream manager to review and approve any changes that seem
>>>>>>> beyond editorial in nature, e.g., addition of new text, deletion of text,
>>>>>>> and technical changes.  Information about stream managers can be found in
>>>>>>> the FAQ.  Editorial changes do not require approval from a stream manager.
>>>>>>> 
>>>>>>> 
>>>>>>> Approving for publication
>>>>>>> --------------------------
>>>>>>> 
>>>>>>> To approve your RFC for publication, please reply to this email stating
>>>>>>> that you approve this RFC for publication.  Please use ‘REPLY ALL’,
>>>>>>> as all the parties CCed on this message need to see your approval.
>>>>>>> 
>>>>>>> 
>>>>>>> Files
>>>>>>> -----
>>>>>>> 
>>>>>>> The files are available here:
>>>>>>> https://www.rfc-editor.org/authors/rfc10004.xml
>>>>>>> https://www.rfc-editor.org/authors/rfc10004.html
>>>>>>> https://www.rfc-editor.org/authors/rfc10004.pdf
>>>>>>> https://www.rfc-editor.org/authors/rfc10004.txt
>>>>>>> 
>>>>>>> Diff file of the text:
>>>>>>> https://www.rfc-editor.org/authors/rfc10004-diff.html
>>>>>>> https://www.rfc-editor.org/authors/rfc10004-rfcdiff.html (side by side)
>>>>>>> 
>>>>>>> Diff of the XML:
>>>>>>> https://www.rfc-editor.org/authors/rfc10004-xmldiff1.html
>>>>>>> 
>>>>>>> 
>>>>>>> Tracking progress
>>>>>>> -----------------
>>>>>>> 
>>>>>>> The details of the AUTH48 status of your document are here:
>>>>>>> https://www.rfc-editor.org/auth48/rfc10004
>>>>>>> 
>>>>>>> Please let us know if you have any questions.
>>>>>>> 
>>>>>>> Thank you for your cooperation,
>>>>>>> 
>>>>>>> RFC Editor
>>>>>>> 
>>>>>>> --------------------------------------
>>>>>>> RFC 10004 (draft-ietf-lamps-rfc5274bis)
>>>>>>> 
>>>>>>> Title            : Certificate Management Messages over CMS (CMC): Compliance Requirements
>>>>>>> Author(s)        : J. Mandel,
>>>>>>>              S. Turner
>>>>>>> WG Chair(s)      : Russ Housley, Tim Hollebeek
>>>>>>> Area Director(s) : Deb Cooley, Christopher Inacio
>>>>>> 
>>>>> 
>>>> 
>>> 
>> 
>