[CDNi] review of draft-ietf-cdni-interfaces-https-delegation-11

[Thomas Fossati <[e-mail]>]

Hi Fred, Sanjay, Emil,

I have reviewed draft-ietf-cdni-interfaces-https-delegation-11.  I think
the document is on the right track although there are still a few things
that need to be ironed out before it's fully usable.  I am happy to work
with you on each of the points I've made below.

BTW, I wanted to provide some of my comments as PRs but it doesn't look
like the latest version is on GitHub [1]?

[1] https://github.com/FredericFi/cdni-wg

# Abstract

Plural/singular mismatch:

OLD
a new Footprint and Capabilities metadata objects

NEW
new Footprint and Capabilities metadata objects

---

You need to explain what you mean by "HTTPS delegation", e.g.:

OLD
to support HTTPS delegation between two or more interconnected CDNs.

NEW
to support delegating the delivery of HTTPS traffic between two or more
interconnected CDNs.

---

Maybe explain the advantages of using ACME Delegation over private key
sharing, e.g.:

OLD
Specifically, this document outlines CDNI Metadata interface objects for
delegation method as published in the ACME-STAR document [RFC9115].

NEW
Specifically, this document outlines CDNI Metadata interface objects for
HTTPS delegation based on the interfaces for obtaining delegated
certificates defined by RFC9115.  Using RFC9115-profiled ACME avoids the
need to share private cryptographic key material between the involved
entities, while also allowing the delegating CDN to remain in full
control of the delegation and revoke it at any time.

# §1. Introduction

First para: You could be more explicit about the fact that the
credential delegation is needed when DNS-based redirection is used.  In
fact, HTTP-based redirection has no special requirements in terms of
credential management -- though it has higher TTFB.

Second, third and fourth para may be condensed taking RFC9115 by
reference and using pointers to its §1, §2.4, §5.1.2, §5.1.2.1.

# §2. Terminology

I think it's also worth pointing to §1.1 of 9115 and §1.2 of 8739 for
ACME Delegation / STAR specific lingo.

# §3. Advertising delegation metadata for CDNI through FCI

OLD
The FCI.Metadata object shall allow a dCDN to advertise the

NEW
The FCI.Metadata object is used by the dCDN to advertise the

One thing that it's not fully clear to me is whether you want to only
use STAR or you also allow non-STAR delegation?  9115 defines both flows
(see §2.3.2 and §2.3.3, and also §2.3.6.1 and §2.3.6.2), whilst you only
define a AcmeStarDelegationMethod.  I think you need to be more explicit
regarding which subset of 9115 you mean to leverage.

(typo: AcmeStarDelegationDelegationMethod)

# §4. ACME Delegation metadata for CDNI

I am wondering what is the best way to reuse the material from §5.1.2.1
of 9115 (esp. Figure 11).  Maybe you could just copy it over?  In case
you can find the source for the pics here [2], [3].

[2] https://raw.githubusercontent.com/yaronf/I-D/main/STAR-Delegation/art/cdni-dns-redirection.ascii-art
[3] https://raw.githubusercontent.com/yaronf/I-D/main/STAR-Delegation/art/cdni-delegation.ascii-art

I reckon Figure 1 provides a good overview of the overall process, but
lacks a bit of detail to be really useful to an implementer / deployer.

In general ISTM that there is some missing link-up to do with the
relevant sections in 9115 here.  I'd be more than happy to help closing
the gap.

Cheers, t

---
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.