Re: [CDNi] [E] review of draft-ietf-cdni-interfaces-https-delegation-11

["Mishra, Sanjay" <[e-mail]>]

Hi Thomas - Thank you for your detailed review. All your comments are
extremely helpful and help add content and clarity.

Fred can also move the document to Github so it may be easier to
collaborate and yes certainly can use your help to make sure your points
are accurately captured.

Thank you
Sanjay

On Thu, Aug 25, 2022 at 5:05 PM Thomas Fossati <[e-mail]>
wrote:

> Hi Fred, Sanjay, Emil,
>
>
>
> I have reviewed draft-ietf-cdni-interfaces-https-delegation-11.  I think
>
> the document is on the right track although there are still a few things
>
> that need to be ironed out before it's fully usable.  I am happy to work
>
> with you on each of the points I've made below.
>
>
>
> BTW, I wanted to provide some of my comments as PRs but it doesn't look
>
> like the latest version is on GitHub [1]?
>
>
>
> [1] https://github.com/FredericFi/cdni-wg
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_FredericFi_cdni-2Dwg&d=DwQFAw&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=8IwOuTeIt9K2Rjg7nWR85NE4dSuX8KqyHTuYvoDbc1rxHDZO5cPzXPCiZEeZpl3A&s=Kh75YtdtIe8RWZpwRe_YQnOUQAiwXqnwTK9FCCxxuhM&e=>
>
>
>
> # Abstract
>
>
>
> Plural/singular mismatch:
>
>
>
> OLD
>
> a new Footprint and Capabilities metadata objects
>
>
>
> NEW
>
> new Footprint and Capabilities metadata objects
>
>
>
> ---
>
>
>
> You need to explain what you mean by "HTTPS delegation", e.g.:
>
>
>
> OLD
>
> to support HTTPS delegation between two or more interconnected CDNs.
>
>
>
> NEW
>
> to support delegating the delivery of HTTPS traffic between two or more
>
> interconnected CDNs.
>
>
>
> ---
>
>
>
> Maybe explain the advantages of using ACME Delegation over private key
>
> sharing, e.g.:
>
>
>
> OLD
>
> Specifically, this document outlines CDNI Metadata interface objects for
>
> delegation method as published in the ACME-STAR document [RFC9115].
>
>
>
> NEW
>
> Specifically, this document outlines CDNI Metadata interface objects for
>
> HTTPS delegation based on the interfaces for obtaining delegated
>
> certificates defined by RFC9115.  Using RFC9115-profiled ACME avoids the
>
> need to share private cryptographic key material between the involved
>
> entities, while also allowing the delegating CDN to remain in full
>
> control of the delegation and revoke it at any time.
>
>
>
> # §1. Introduction
>
>
>
> First para: You could be more explicit about the fact that the
>
> credential delegation is needed when DNS-based redirection is used.  In
>
> fact, HTTP-based redirection has no special requirements in terms of
>
> credential management -- though it has higher TTFB.
>
>
>
> Second, third and fourth para may be condensed taking RFC9115 by
>
> reference and using pointers to its §1, §2.4, §5.1.2, §5.1.2.1.
>
>
>
> # §2. Terminology
>
>
>
> I think it's also worth pointing to §1.1 of 9115 and §1.2 of 8739 for
>
> ACME Delegation / STAR specific lingo.
>
>
>
> # §3. Advertising delegation metadata for CDNI through FCI
>
>
>
> OLD
>
> The FCI.Metadata object shall allow a dCDN to advertise the
>
>
>
> NEW
>
> The FCI.Metadata object is used by the dCDN to advertise the
>
>
>
> One thing that it's not fully clear to me is whether you want to only
>
> use STAR or you also allow non-STAR delegation?  9115 defines both flows
>
> (see §2.3.2 and §2.3.3, and also §2.3.6.1 and §2.3.6.2), whilst you only
>
> define a AcmeStarDelegationMethod.  I think you need to be more explicit
>
> regarding which subset of 9115 you mean to leverage.
>
>
>
> (typo: AcmeStarDelegationDelegationMethod)
>
>
>
> # §4. ACME Delegation metadata for CDNI
>
>
>
> I am wondering what is the best way to reuse the material from §5.1.2.1
>
> of 9115 (esp. Figure 11).  Maybe you could just copy it over?  In case
>
> you can find the source for the pics here [2], [3].
>
>
>
> [2]
> https://raw.githubusercontent.com/yaronf/I-D/main/STAR-Delegation/art/cdni-dns-redirection.ascii-art
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__raw.githubusercontent.com_yaronf_I-2DD_main_STAR-2DDelegation_art_cdni-2Ddns-2Dredirection.ascii-2Dart&d=DwQFAw&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=8IwOuTeIt9K2Rjg7nWR85NE4dSuX8KqyHTuYvoDbc1rxHDZO5cPzXPCiZEeZpl3A&s=Z4UzaQQwpZS-nhAZNc8f9JyWM7IbPaLz1vNeUi73MGc&e=>
>
> [3]
> https://raw.githubusercontent.com/yaronf/I-D/main/STAR-Delegation/art/cdni-delegation.ascii-art
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__raw.githubusercontent.com_yaronf_I-2DD_main_STAR-2DDelegation_art_cdni-2Ddelegation.ascii-2Dart&d=DwQFAw&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=8IwOuTeIt9K2Rjg7nWR85NE4dSuX8KqyHTuYvoDbc1rxHDZO5cPzXPCiZEeZpl3A&s=tTwb2kOstEcCiccoff-YBFx6x3gpIXWss25RcLBnQOU&e=>
>
>
>
> I reckon Figure 1 provides a good overview of the overall process, but
>
> lacks a bit of detail to be really useful to an implementer / deployer.
>
>
>
> In general ISTM that there is some missing link-up to do with the
>
> relevant sections in 9115 here.  I'd be more than happy to help closing
>
> the gap.
>
>
>
> Cheers, t
>
>
>
> ---
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
>