Re: [CDNi] Éric Vyncke's Discuss on draft-ietf-cdni-uri-signing-21: (with DISCUSS and COMMENT)

[Phil Sorber <[e-mail]>]

Thank you for this thorough review. I have added my responses below.

On Tue, Feb 23, 2021 at 6:50 AM Éric Vyncke via Datatracker <
[e-mail]> wrote:

> Éric Vyncke has entered the following ballot position for
> draft-ietf-cdni-uri-signing-21: Discuss
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/
>
>
>
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
>
> Thank you for the work put into this document.
>
> Special thanks for the doc shepherd write-up , which was really useful
> about
> the WG history.
>
> Please find below one blocking DISCUSS points (which should be solved
> easily),
> one non-blocking COMMENT point (but replies would be appreciated), and some
> nits.
>
> I hope that this helps to improve the document,
>
> Regards,
>
> -éric
>
> == DISCUSS ==
>
> -- Section 2.1.10 --
> About "Client IP (cdniip) claim", I really wonder whether this could be
> used in
> real life as some IPv4 Carrier-Grade NAT (CGN) have a large pool of
> "public"
> IPv4 addresses that could select different public IPv4 addresses if badly
> designed. How will it work with dual-stack UAs where some connections
> could be
> over IPv4 and some over IPv6 ? Now to mention a dual-home (Wi-Fi & mobile
> data)
> UA ? Or what if the dCDN is between the UA and the CGN (assuming that the
> uCDN
> or CSP are upstream of the CGN) ?
>

The cdniip claim is considered optional. So it's up to the CSP to determine
if this is needed or not, or if it's even useful. It's something that has
been common in the space and we needed it to maintain feature parity with
existing solutions that we intended to replace. There are definitely
limitations to its use, but it is something we have to include.


>
> Also, "If the received signed JWT contains a Client IP claim" uses singular
> rather than "one or several"
>

I'm not sure I follow. Can you explain how you would change it?


>
> I also noted that Section 7 (security considerations) puts some
> restrictions on
> the usefulness of cdniip.
>
> I would welcome some applicability statements on the use of cdniip.
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> == COMMENTS ==
>
> -- Section 1.3 --
> To be honest, I fail to understand the meaning (hence the value) of figure
> 3.
>

It's summarizing whose key of what type to be used in different scenarios,
but I agree it's not very helpful. I'll remove it.


>
>
> == NITS ==
>
> I am afraid that the email address [e-mail] is outdated.
>

I'll look into this.


>
> -- Section 1 --
> Is CDNI "interconnected CDNs (CDNI)" or "CDN Interconnection (CDNI)" ?
>

The latter. I will fix the first one.


>
>
>
> _______________________________________________
> CDNi mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/cdni
>