Re: [CDNi] [E] Re: I-D Action: draft-ietf-cdni-https-delegation-subcerts-05.txt

["Mishra, Sanjay" <[e-mail]>]

Hi Christoph - Thank you for submitting an updated version 5. I have
reviewed the document and I have following comments:


   1. Section 2 Terminology. Reference to RFC8174 is missing, i.e.
   something like "...in this document are to be interpreted as described in
   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here....". If needed, you can refer to BCP14 (
   https://www.rfc-editor.org/info/bcp14).
   2. This document when referring to RFC8008 refers it as "CDNI Footprint
   and Capabilities interface", however, the RFC 8008, defines the document as
   "Footprint & Capabilities Advertisement interface (FCI)", suggest to make
   it consistent with the referred document
   3. General: Document sometime refers to "Delegated Credentials" and
   sometime "Delegated Credential", suggest to use former throughout the
   document
   4. Also check what is the correct usage you want to use throughout the
   document for lower case "delegated credentials" and "delegated credential"
   (In sec 7 both are used in the same context)
   5. Sec 3: Use hyperlink for reference to RFC8008
   6. Sec 3: "as shown in below example" -> "as shown in the example below:"
   7. For the following text "There is also a need to announce additional
   parameters related to the number of credentials supported by the dCDN. For
   that purpose we introduce the FCI object FCI.DelegationCredentials." would
   it be helpful to give some context, for example, say something like, "This
   document also defines an object that announces to the delegating entity how
   many delegated credentials the downstream supports such that the delegating
   entity can provide corresponding number of delegated credentials".
   8. Sec 3.1: Instead of using "linked with the number of servers in the
   dCDN", suggest something like, "corresponding to the number of servers
   designated by the dCDN to support delegated credentials"
   9. Sec 3.1: "if ever such private keys are transmitted" -> "whenever the
   private keys are transmitted
   10. Sec 3.2: Typo in the header "Expected usage of the propert number of
   supported delegated credentials"
   11. Sec 3.2: "The dCDN uses the FCI.DelegatedCredentials object to
   announce the number of endpoints as the number of supported delegated
   credentials" -> The dCDN uses the FCI.DelegatedCredentials object to
   announce the number of servers that support   delegated credentials".
   12. Sec 3.2: "it can provide..." -> "it can issue...."
   13. Sec 3.2: "of the dCDN" -> "to the dCDN"
   14. Sec 3.2: The statement says "Once the uCDN has provided delegated
   credentials via the MI, uCDN SHOULD monitor the provided credentials and
   their expiry times. The uCDN SHOULD timely refresh dCDN credentials via the
   MI."
      - Since this is a SHOULD for the issuer of delegated credentials"
      (DC), how would dCDN handle when serving midstream the DC expires because
      the uCDN did not follow through?
      - Also suggest to use "MI object" rather than just MI
   15. Sec 4: Suggest to maintain uniformity of naming the "designator",
   here is the document for the first time refers the designator or the uCDN
   issuing delegated credentials is "origin", and this term may be ambiguous
   as the "origin" can be other than the issuer of DC
   16. Sec 4: "cred"? Typo?
   17. Sec 4: "follows." -> "follows:"
   18. Sec 4: "find an example" -> "see an example" & " object." ->
   "Object:"
   19. Sec 5: "in CDNI" is not required in the sentence
   20. Sec 5: Elsewhere this draft refers to "User Agent", but this section
   describes it as a "Client", suggesting use the same naming convention when
   identifying it
   21. Sec 5: "This document requests the registration" -> "This document
   requests IANA the registration..."
   22. Sec 6.1 "MI objects" or "MI Objects"?
   23. Sec 7: "in the present document" -> "in the document"
   24. Sec 7: "enable" -> "enables"
   25. Sec 7: Where is this established that "The delegated credentials and
   associated private keys are short-lived"?
   26. Sec 7: "Still, it is NOT RECOMMENDED to send private keys through
   the MI as omitting the private key" Suggest to add a "." after MI and then
   start a new sentence without "as".

Thanks
Sanjay

On Thu, Oct 5, 2023 at 9:57 AM Christoph Neumann <
[e-mail]> wrote:

> Hi all,
>
> I submitted a new version of the internet draft related to delegated
> credentials.
> This update takes into account the secdir reviews of the previous draft.
> The draft now specifies that, if used, the private key must be encrypted
> using JWE, whereas the public key used for encryption can be announced in
> the FCI.DelegatedCredentials.
>
> Christoph
>
> -----Original Message-----
> From: CDNi <[e-mail]> On Behalf Of [e-mail]
> Sent: Thursday, October 5, 2023 9:54 AM
> To: [e-mail]
> Cc: [e-mail]
> Subject: [CDNi] I-D Action:
> draft-ietf-cdni-https-delegation-subcerts-05.txt
>
> Internet-Draft draft-ietf-cdni-https-delegation-subcerts-05.txt is now
> available. It is a work item of the Content Delivery Networks
> Interconnection
> (CDNI) WG of the IETF.
>
>    Title:   CDNI Metadata for Delegated Credentials
>    Authors: Frederic Fieau
>             Emile Stephan
>             Guillaume Bichot
>             Christoph Neumann
>    Name:    draft-ietf-cdni-https-delegation-subcerts-05.txt
>    Pages:   12
>    Dates:   2023-10-05
>
> Abstract:
>
>    The delivery of content over HTTPS involving multiple CDNs raises
>    credential management issues.  This document defines metadata in the
>    CDNI Control and Metadata interface to setup HTTPS delegation using
>    Delegated Credentials from an Upstream CDN (uCDN) to a Downstream CDN
>    (dCDN).
>
> The IETF datatracker status page for this Internet-Draft is:
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dcdni-2Dhttps-2Ddelegation-2Dsubcerts_&d=DwIGaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=2OE4Zo9YZweaSYyOlNecmOEeHpfeRxtXKHAZ03MvTWa28qwZlDIcNgLItOTRAWYi&s=QjgYpkSYwF018CGQdB5D6OgaPA6JvV--xLnPG8AX5zs&e=
>
> There is also an HTMLized version available at:
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_html_draft-2Dietf-2Dcdni-2Dhttps-2Ddelegation-2Dsubcerts-2D05&d=DwIGaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=2OE4Zo9YZweaSYyOlNecmOEeHpfeRxtXKHAZ03MvTWa28qwZlDIcNgLItOTRAWYi&s=NnHNfxiTuAjX152dgmDVvSb59WYeZul6ahF7z3rHsn8&e=
>
> A diff from the previous version is available at:
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__author-2Dtools.ietf.org_iddiff-3Furl2-3Ddraft-2Dietf-2Dcdni-2Dhttps-2Ddelegation-2Dsubcerts-2D05&d=DwIGaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=2OE4Zo9YZweaSYyOlNecmOEeHpfeRxtXKHAZ03MvTWa28qwZlDIcNgLItOTRAWYi&s=GSFYIUydwTDMwna16Fo6Ye56N0By16N71f3Zj3KoVv4&e=
>
> Internet-Drafts are also available by rsync at:
> rsync.ietf.org::internet-drafts
>
>
> _______________________________________________
> CDNi mailing list
> [e-mail]
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_cdni&d=DwIGaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=2OE4Zo9YZweaSYyOlNecmOEeHpfeRxtXKHAZ03MvTWa28qwZlDIcNgLItOTRAWYi&s=FP0OVV1i-_EID9-3MAV-RDon2JT7oXWeuJxpBAq58Yg&e=
> Broadpeak, S.A. Registered offices at 15 rue Claude Chappe, Zone des
> Champs Blancs, 35510 Cesson-Sévigné, France | Rennes
> Trade Register: 524 473 063
> This e-mail and its attachments contain confidential information from
> Broadpeak S.A. and/or its affiliates (Broadpeak), which is intended only
> for the person to whom it is addressed.
> If you are not the intended recipient of this email, please notify
> immediately the sender by phone or email and delete it. Any use of the
> information contained herein in any way, including, but not limited to,
> total or partial disclosure, reproduction, or dissemination, by persons
> other than the intended recipient(s) is prohibited, unless expressly
> authorized by Broadpeak. Broadpeak, S.A. and its affiliates respect privacy
> laws, and is committed to the protection of personal data. Emails and/or
> attachments thereof exchanged between us may include your personal data
> which may be processed by Broadpeak and/or its affiliates according to
> applicable privacy laws & regulations.
> In compliance with Regulation (EU) 2016/679 (GDPR) and applicable
> implementation in local legislations, you can exercise at any time your
> rights of access, rectification or erasure of your personal data, as well
> as your rights to restriction, portability or object to the processing.
> For such purpose, or to know more about how Broadpeak processes your
> personal data, you may contact Broadpeak by email [e-mail].
> Local authority : Commission Nationale Informatique et Libertés (CNIL): 3
> Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07 or
> https://urldefense.proofpoint.com/v2/url?u=http-3A__www.cnil.fr_&d=DwIGaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=2OE4Zo9YZweaSYyOlNecmOEeHpfeRxtXKHAZ03MvTWa28qwZlDIcNgLItOTRAWYi&s=rdM_eAM3u6idUBvqMtTIEdfhkoC5KGA1ygkVZZ45ce0&e=
> _______________________________________________
> CDNi mailing list
> [e-mail]
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_cdni&d=DwIGaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=XniVbishGiO2Ao9hKqSc-hTVIWCi3T-x6GdHR4ZTgoM&m=2OE4Zo9YZweaSYyOlNecmOEeHpfeRxtXKHAZ03MvTWa28qwZlDIcNgLItOTRAWYi&s=FP0OVV1i-_EID9-3MAV-RDon2JT7oXWeuJxpBAq58Yg&e=
>