[secdir] draft-ietf-stir-certificates-ocsp-11 ietf last call Secdir review

Phillip Hallam-Baker via Datatracker <noreply@ietf.org> Sun, 03 August 2025 16:55 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: Phillip Hallam-Baker via Datatracker <noreply@ietf.org>
To: secdir@ietf.org
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <175424010056.872249.2305887615557531087@dt-datatracker-5bd446d5fd-c47nq>
Date: Sun, 03 Aug 2025 09:55:00 -0700
Message-ID-Hash: NE7IA6DCUFTKBI35LMH4W5SDY6PGDPBB
CC: draft-ietf-stir-certificates-ocsp.all@ietf.org, last-call@ietf.org, stir@ietf.org
Reply-To: Phillip Hallam-Baker <hallam@gmail.com>
Subject: [secdir] draft-ietf-stir-certificates-ocsp-11 ietf last call Secdir review
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/61FdUuGIGph91pCfLNhCsdRu84Q>

Document: draft-ietf-stir-certificates-ocsp
Title: OCSP Usage for Secure Telephone Identity Certificates
Reviewer: Phillip Hallam-Baker
Review result: Has Issues

The Security Considerations section needs to be more than just
'this document is all about security'.

The privacy considerations section needs to be cited as the information
relating to certificate (and hence subscriber activity) leaking is also a
security consideration. Operators of the OCSP services need to take appropriate
measures.

Another dimension that needs to be considered is service. The loss of the OCSP
service potentially results in a subscriber being unable to place or receive a
call. The OSCP service may be a target for a DoS attack. While stapling
mitigates this, it does not eliminate it.

[secdir] draft-ietf-stir-certificates-ocsp-11 iet… Phillip Hallam-Baker via Datatracker
[secdir] Re: draft-ietf-stir-certificates-ocsp-11… Peterson, Jon