Re: [secdir] Secdir last call review of draft-ietf-emu-eaptlscert-06

[Benjamin Kaduk <[e-mail]>]

Hi Stefan,

Thanks for the review; it raises some good topics.
Replying on a couple points...

On Thu, Oct 29, 2020 at 04:13:02PM -0700, Stefan Santesson via Datatracker wrote:
> Reviewer: Stefan Santesson
> Review result: Has Nits
> 
> The document in general is good and well written.
> 
> Some nits needs attention before publication as the general review also points
> out. Ex in the abstract "This document looks at the this problem"
> 
> Some abbreviations needs to be spelled out at first usage, such as MTU (Maximum
> Transmission Unit)

MTU may actually be okay; per
https://www.rfc-editor.org/materials/abbrev.expansion.txt it is marked as
"well-known" and does not always need to be expanded.

> On the content itself I have two questions:
> 
> - Wouldn't it be relevant to also discuss the risks with regard to introduction
> of quantum safe crypto, if that leads to significantly increased key sizes? It
> could be troublesome if transition to a safer crypto is made impossible due to
> size limitations. - Would it be relevant to discuss usage of AIA extension as
> means of possibly excluding intermediary certs from the path as they could be
> located using AIA?
> 
> Finally, I agree with the general review that this document reference quite
> some work in progress. If this document is to be published before these
> referenced works are concluded, are there alternatives to make the same point?

They seem to mostly be informative references, and so would not require us
to hold publication of this document.  It is probably still worth
considering if there are alternatives anyway, though.

-Ben