Re: [Hipsec] I-D Action:draft-ietf-hip-cert-03.txt

[Samu Varjonen <[e-mail]>]

Hi,

Sorry for the delayed answer.

Comments inline.

Mattes, David wrote:
> Hi Tobias and Samu,
> 
> Thank you for this work!
> 
> Some comments:
> Section 2, last paragraph, 2nd sentence: s/LDAP URL/DN/

OK

> 
> Section 3, paragraph 1: I don't agree that HITs need to be enclosed within X.509 certificates.  Many users will not have control over the Certificate Issuing Authorities, or even if they do have that control, will be unable to specify inclusion of the HIT in the certificate.  Furthermore, the issuer may not be involved in HIP communications at all!  I think it is a mistake to require _any_ HIP details to be present in a certificate used for HIP communications, nor do I see why it is necessary.

Yes, we agree that HITs are not always needed or even possible for the user to 
add to the certificates. The text should be lessened to say something along the 
lines of "if HITs are needed in the certificates this is how you use them"

> 
> Section 3, can we add another example that describes a managed PKI environment?  If you agree with my comment about HITs in the certificate, I will write up an example for this case.
> 

This is one of the remaining items on the todo list and we would appreciate your 
contribution.

> Regards,
> David Mattes
> 
> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of [e-mail]
> Sent: Wednesday, April 28, 2010 1:45 AM
> To: [e-mail]
> Cc: [e-mail]
> Subject: [Hipsec] I-D Action:draft-ietf-hip-cert-03.txt
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Host Identity Protocol Working Group of the IETF.
> 
> 
> 	Title           : HIP Certificates
> 	Author(s)       : T. Heer, S. Varjonen
> 	Filename        : draft-ietf-hip-cert-03.txt
> 	Pages           : 10
> 	Date            : 2010-04-28
> 
> This document specifies a certificate parameter called CERT for the Host Identity Protocol (HIP).  The CERT parameter is a container for
> X.509.v3 certificates and for Simple Public Key Infrastructure (SPKI) certificates.  It is used for carrying these certificates in HIP control packets.  Additionally, this document specifies the representations of Host Identity Tags in X.509.v3 and in SPKI certificates.
> 
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-hip-cert-03.txt
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft.