[CDNi] Éric Vyncke's Abstain on draft-ietf-cdni-uri-signing-24: (with COMMENT)

[Éric Vyncke via Datatracker <[e-mail]>]

Éric Vyncke has entered the following ballot position for
draft-ietf-cdni-uri-signing-24: Abstain

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/blog/handling-iesg-ballot-positions/
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for fixing all my previous COMMENTs in the -22 revision and
addressing parts of my previous DISCUSS by using “NOT RECOMMENDED” in section
2.1.10 in the -24 revision.

I am afraid that I still do not see the value of having cdniip in this
document, but, as I do not want to block this document, I am balloting ABSTAIN.

The section 7 (security considerations) is still very light on the IP address
sharing. I would welcome some applicability statements on the use of cdniip.

-éric

== DISCUSS (kept for archive) ==

-- Section 2.1.10 --
About "Client IP (cdniip) claim", I really wonder whether this could be used in
real life as some IPv4 Carrier-Grade NAT (CGN) have a large pool of "public"
IPv4 addresses that could select different public IPv4 addresses if badly
designed. How will it work with dual-stack UAs where some connections could be
over IPv4 and some over IPv6 ? Now to mention a dual-home (Wi-Fi & mobile data)
UA ? Or what if the dCDN is between the UA and the CGN (assuming that the uCDN
or CSP are upstream of the CGN) ?

Also, "If the received signed JWT contains a Client IP claim" uses singular
rather than "one or several"

I also noted that Section 7 (security considerations) puts some restrictions on
the usefulness of cdniip.

I would welcome some applicability statements on the use of cdniip.