Re: [Hipsec] draft-ietf-hip-cert-04-pre01

[Ari Keranen <[e-mail]>]

Hi Samu,

On 06/16/2010 01:16 PM, Samu Varjonen wrote:
> Here is the preversion of the draft-ietf-hip-cert-04
> http://www.cs.helsinki.fi/u/sklvarjo/draft-ietf-hip-cert-04-pre02.txt

Great! Looking forward seeing this work finalized.

[...]
> Comments are appreciated...

Some comments:

The document would benefit from using more normative language, i.e., 
capitalizing the relevant shoulds/musts/mays and thinking once more 
through which form is appropriate.


2.  CERT Parameter

    The CERT parameter is covered by the HIP SIGNATURE field and is a
    non-critical parameter.

This is better than the previous version, but I'd suggest adding "(where 
present)" after "is covered" to point out that in I1 it would not be 
covered by a signature.

    Cert groups may only span multiple
    packets if the Cert group does not fit the packet.

What packet size limit should one use for determining this? Next hop 
MTU, PMTUD, or something?

              |         URL of X.509.v3        |      3      |
              |           URL of SPKI          |      4      |
              |        Hash of X.509.v3        |      5      |
              |          Hash of SPKI          |      6      |
[...]
    Hash and URL encodings (3 to 6) are used as defined in [RFC4306].

I'd recommend adding the corresponding section number(s) to the 
reference since the IKEv2 spec is quite a long one. And if I understand 
RFC4306 correctly, you should not have separate "Hash" and "URL" 
encodings, but just "Hash and URL" that contains concatenation of the 
hash and URL.


7.  IANA Considerations

Should the certificate types have their own registry?



Cheers,
Ari