Re: [auth48] [E] Re: AUTH48: RFC-to-be 9538 <draft-ietf-cdni-delegation-acme-04> for your review

[[e-mail]]

Hi Alice

I hope you are well.

I approve to the 4 new wording suggested below.

Tell me if you expect a more detailed answer.

Kind regards
Emile



From: Mishra, Sanjay <[e-mail]>
Sent: mercredi 7 février 2024 18:31
To: Alice Russo <[e-mail]>
Cc: FIEAU Frédéric INNOV/NET <[e-mail]>; STEPHAN Emile INNOV/NET <[e-mail]>; Mishra, Sanjay <sanjay.mishra=[e-mail]>; [e-mail]; [e-mail]; [e-mail]; [e-mail]; [e-mail]; auth48archive <[e-mail]>
Subject: Re: [E] Re: AUTH48: RFC-to-be 9538 <draft-ietf-cdni-delegation-acme-04> for your review

Hi Alice - Thank you and please see response below for the 4 questions:

1) <!--[rfced] May this be rephrased as follows for readability?

Original:
   RFC9115 allows delegating entities to remain in
   full control of the delegation and be able to revoke it any time and
   this avoids the need to share private cryptographic key material
   between the involved entities.

Perhaps:
   Per RFC 9115, delegating entities can remain in
   full control of the delegation and can revoke it at any time.
   This avoids the need to share private cryptographic key material
   between the involved entities.
-->
Yes, I approve the new wording as suggested above



2) <!--[rfced] FYI, in Section 1.1, we added mention of "STAR" so that it
is expanded upon first use. Please let us know if you prefer otherwise.
(In the original, the first use was in Section 3 - "ACME STAR delegation"
was followed by explanation but was without a direct expansion.)

Original:
   It also uses
   terminology from Section 1.2 of [RFC8739] and Section 1.1 of
   [RFC9115].

Current:
   It also uses
   terminology from Section 1.2 of [RFC8739] and Section 1.1 of
   [RFC9115], including Short-Term, Automatically Renewed (STAR),
   as applied to X.509 certificates.
-->
Yes, I approve of the new wording as above.

3) <!--[rfced] How may this sentence be rephrased for clarity? In particular,
"allows to specify" is not clear. Also, Section 2.3.1.3 of RFC 9115
indicates that the CNAME mapping is optional; should this sentence be
updated to reflect that?

Original:
      |   Note: The delegation object defined in Section 2.3.1.3 of
      |  [RFC9115] only allows to specify DNS mappings using CNAME RRs.

Perhaps:
      |   Note: The delegation object defined in Section 2.3.1.3 of
      |  [RFC9115] only allows DNS mappings to be specified using CNAME RRs.
Yes, I approve the above wording as suggested

Or:
      |   Note: The delegation object defined in Section 2.3.1.3 of
      |  [RFC9115] allows DNS mappings to be specified using only CNAME RRs.
-->

4) <!--[rfced] FYI, for readability and precision, we have made the following
updates: split this into two sentences, changed "criticality around"
to "criticality of", and changed "which" to "this account".
Please review and let us know if you prefer otherwise.

Original:
   The reader is expected to understand the ACME delegation trust model
   (Section 7.1 of [RFC9115]) and security goal (Section 7.2 of
   [RFC9115]), in particular the criticality around the protection of
   the user account associated with the delegation, which authorizes all
   the security relevant operations between dCDN and uCDN over the ACME
   channel.

Current:
   The reader is expected to understand the ACME delegation trust model
   (Section 7.1 of [RFC9115]) and security goal (Section 7.2 of
   [RFC9115]).  In particular, the reader is expected to understand the
   criticality of the protection of the user account associated with the
   delegation; this account authorizes all the security-relevant
   operations between a dCDN and a uCDN over the ACME channel.

Yes, I approve of the suggested text.

Thank you very much
Best
Sanjay

On Wed, Feb 7, 2024 at 12:17 PM Alice Russo <[e-mail]<mailto:[e-mail]>> wrote:
Authors,

Sanjay, thank you for your reply and for letting us know about Frederic's reply to the CDNI mailing list.

Please reply to the 4 questions below regarding changes to the text.

The edited document is here:
  https://www.rfc-editor.org/authors/rfc9538.html<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rfc-2Deditor.org_authors_rfc9538.html&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=ERNt_sWBTn0aYI_tDCaQC_ywG1qws-Ir4ncBTIAyRZOVrkbHe3FeVoc9sDAYr1rM&s=XOsYGqdULf1sukFz5ueGCAT59-g7YGPn8rgacJ7W59E&e=>
  https://www.rfc-editor.org/authors/rfc9538.pdf<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rfc-2Deditor.org_authors_rfc9538.pdf&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=ERNt_sWBTn0aYI_tDCaQC_ywG1qws-Ir4ncBTIAyRZOVrkbHe3FeVoc9sDAYr1rM&s=AR7UVig_EBXmdUtR4mK3K7aCK8y9zvlYqbtPUQI0w-U&e=>
  https://www.rfc-editor.org/authors/rfc9538.txt<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rfc-2Deditor.org_authors_rfc9538.txt&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=ERNt_sWBTn0aYI_tDCaQC_ywG1qws-Ir4ncBTIAyRZOVrkbHe3FeVoc9sDAYr1rM&s=UEqFill8vd79sdKkszQMoP3mG1cAbOptksTuj_o1RAA&e=>
  https://www.rfc-editor.org/authors/rfc9538.xml<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rfc-2Deditor.org_authors_rfc9538.xml&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=ERNt_sWBTn0aYI_tDCaQC_ywG1qws-Ir4ncBTIAyRZOVrkbHe3FeVoc9sDAYr1rM&s=sQ2qP5GPRdAlTIJimPXGx3poU_3Bmwe_Eve0EDFt6MM&e=> (source)

Diff files of all changes from the approved Internet-Draft:
  https://www.rfc-editor.org/authors/rfc9538-diff.html<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rfc-2Deditor.org_authors_rfc9538-2Ddiff.html&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=ERNt_sWBTn0aYI_tDCaQC_ywG1qws-Ir4ncBTIAyRZOVrkbHe3FeVoc9sDAYr1rM&s=j5juTW6xkNnHae-eThUeVyNCPJgnLlTKfEDsKSAbtR4&e=>
  https://www.rfc-editor.org/authors/rfc9538-rfcdiff.html<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rfc-2Deditor.org_authors_rfc9538-2Drfcdiff.html&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=ERNt_sWBTn0aYI_tDCaQC_ywG1qws-Ir4ncBTIAyRZOVrkbHe3FeVoc9sDAYr1rM&s=1JzhUM7fy4pM8kLTjy50JTkKEU37JXJDuK-T4AfW0_E&e=> (side by side)

This page shows the AUTH48 status of your document:
  https://www.rfc-editor.org/auth48/rfc9538<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rfc-2Deditor.org_auth48_rfc9538&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=ERNt_sWBTn0aYI_tDCaQC_ywG1qws-Ir4ncBTIAyRZOVrkbHe3FeVoc9sDAYr1rM&s=FdyiphjMOKvHMdbnAQkSp4iXdqWKMnv1ecKrY8MOBMg&e=>

In addition to the authors' responses to the questions, we hope to hear from Emile Stephan, as an approval is needed from each author listed in the first-page header of the RFC.

Thank you.
RFC Editor/ar


On Feb 7, 2024, at 7:21 AM, Mishra, Sanjay <sanjay.mishra=[e-mail]<mailto:sanjay.mishra=[e-mail]>> wrote:

Hi Alice - My co-author Frederic Fieau responded approving this drafts, however, it is a different email thread addressed to [e-mail]<mailto:[e-mail]> so I as confirmation, I'm responding to this thread, I as a co-author along with Emile Stephan and Frederic Fieau have reviewed all changes and approve publication of this document as RFC 9538.

We are thankful to co-chair Kevin Ma for his guidance and the AD, Francesca Palombini and everyone that contributed and commented to this draft and of course a big thanks to the editorial team.

Regards
Sanjay Mishra

snippet of email from Fred is below:
[e-mail]<mailto:[e-mail]>
9:41 AM (37 minutes ago)
to [e-mail]<mailto:[e-mail]>, me, STEPHAN

Dear all,

I have reviewed all changes in draft-ietf-cdni-delegation-acme and concur with them. On behalf of the authors, I approve the document for publication as RFC9538.

I would like to thank the CDNI WG and all individuals who participated for their valuable contributions throughout the process which has now reached its conclusion for this draft.

Regards,
Frederic

On Tue, Feb 6, 2024 at 6:12 PM Alice Russo <[e-mail]<mailto:[e-mail]>> wrote:
Authors,

This is a reminder that we await word from you regarding the questions below and this document's readiness for publication as an RFC. The files are here:

  https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rfc-2Deditor.org_authors_rfc9538.html&d=DwIFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=_uLNEDcaPBsFXYMA8j5oRepqfLBtLE6RKluO5xkPC-kqNuhB9LwWEVarzV9IR2tN&s=5TzFzGWGUvYktrbM8hNWTP8hhGH7e5HbSUIxNf_TLA0&e=
  https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rfc-2Deditor.org_authors_rfc9538.pdf&d=DwIFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=_uLNEDcaPBsFXYMA8j5oRepqfLBtLE6RKluO5xkPC-kqNuhB9LwWEVarzV9IR2tN&s=-ES9wp1LnU6Q7BFV8U-fcv_gUpKgEg8ECmuutDUGb9w&e=
  https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rfc-2Deditor.org_authors_rfc9538.txt&d=DwIFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=_uLNEDcaPBsFXYMA8j5oRepqfLBtLE6RKluO5xkPC-kqNuhB9LwWEVarzV9IR2tN&s=6vBNFP8MiPXcTbSU4PnBrPvuXbyaL7ysXKxiedlaDGc&e=
  https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rfc-2Deditor.org_authors_rfc9538.xml&d=DwIFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=_uLNEDcaPBsFXYMA8j5oRepqfLBtLE6RKluO5xkPC-kqNuhB9LwWEVarzV9IR2tN&s=QyfJ3JEyXCJaYC3zyThHRZBmzKiYNACxoJ4MArXCUK8&e=  (source)

Diff files of all changes from the approved Internet-Draft:
  https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rfc-2Deditor.org_authors_rfc9538-2Ddiff.html&d=DwIFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=_uLNEDcaPBsFXYMA8j5oRepqfLBtLE6RKluO5xkPC-kqNuhB9LwWEVarzV9IR2tN&s=lHSovOjBUHrLUveLLyMBUoqm_IlAWXB37E8HMdIUZ68&e=
  https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rfc-2Deditor.org_authors_rfc9538-2Drfcdiff.html&d=DwIFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=_uLNEDcaPBsFXYMA8j5oRepqfLBtLE6RKluO5xkPC-kqNuhB9LwWEVarzV9IR2tN&s=MjAFFfiY9fQr9Bv5FYsBigSAzexwRe3sL6KOEbvy7PM&e=  (side by side)

This page shows the AUTH48 status of your document:
  https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rfc-2Deditor.org_auth48_rfc9538&d=DwIFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=_uLNEDcaPBsFXYMA8j5oRepqfLBtLE6RKluO5xkPC-kqNuhB9LwWEVarzV9IR2tN&s=-577wxpatCuL4syt5zliTCPSry6dSb98RzaRlHqLg10&e=

Thank you.
RFC Editor/ar

> On Jan 22, 2024, at 10:57 PM, [e-mail]<mailto:[e-mail]> wrote:
>
> Authors,
>
> While reviewing this document during AUTH48, please resolve (as necessary) the
> following questions, which are also in the XML file.
>
> 1) <!--[rfced] May this be rephrased as follows for readability?
>
> Original:
>   RFC9115 allows delegating entities to remain in
>   full control of the delegation and be able to revoke it any time and
>   this avoids the need to share private cryptographic key material
>   between the involved entities.
>
> Perhaps:
>   Per RFC 9115, delegating entities can remain in
>   full control of the delegation and can revoke it at any time.
>   This avoids the need to share private cryptographic key material
>   between the involved entities.
> -->
>
>
> 2) <!--[rfced] FYI, in Section 1.1, we added mention of "STAR" so that it
> is expanded upon first use. Please let us know if you prefer otherwise.
> (In the original, the first use was in Section 3 - "ACME STAR delegation"
> was followed by explanation but was without a direct expansion.)
>
> Original:
>   It also uses
>   terminology from Section 1.2 of [RFC8739] and Section 1.1 of
>   [RFC9115].
>
> Current:
>   It also uses
>   terminology from Section 1.2 of [RFC8739] and Section 1.1 of
>   [RFC9115], including Short-Term, Automatically Renewed (STAR),
>   as applied to X.509 certificates.
> -->
>
>
> 3) <!--[rfced] How may this sentence be rephrased for clarity? In particular,
> "allows to specify" is not clear. Also, Section 2.3.1.3 of RFC 9115
> indicates that the CNAME mapping is optional; should this sentence be
> updated to reflect that?
>
> Original:
>      |   Note: The delegation object defined in Section 2.3.1.3 of
>      |  [RFC9115] only allows to specify DNS mappings using CNAME RRs.
>
> Perhaps:
>      |   Note: The delegation object defined in Section 2.3.1.3 of
>      |  [RFC9115] only allows DNS mappings to be specified using CNAME RRs.
>
> Or:
>      |   Note: The delegation object defined in Section 2.3.1.3 of
>      |  [RFC9115] allows DNS mappings to be specified using only CNAME RRs.
> -->
>
>
> 4) <!--[rfced] FYI, for readability and precision, we have made the following
> updates: split this into two sentences, changed "criticality around"
> to "criticality of", and changed "which" to "this account".
> Please review and let us know if you prefer otherwise.
>
> Original:
>   The reader is expected to understand the ACME delegation trust model
>   (Section 7.1 of [RFC9115]) and security goal (Section 7.2 of
>   [RFC9115]), in particular the criticality around the protection of
>   the user account associated with the delegation, which authorizes all
>   the security relevant operations between dCDN and uCDN over the ACME
>   channel.
>
> Current:
>   The reader is expected to understand the ACME delegation trust model
>   (Section 7.1 of [RFC9115]) and security goal (Section 7.2 of
>   [RFC9115]).  In particular, the reader is expected to understand the
>   criticality of the protection of the user account associated with the
>   delegation; this account authorizes all the security-relevant
>   operations between a dCDN and a uCDN over the ACME channel.
> -->
>
>
> Thank you.
>
> RFC Editor/ar
>
____________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.