Re: [lamps] Request for review of revised RFC 5759

["Paul Hoffman" <[e-mail]>]

On 31 Jan 2018, at 12:59, Michael Jenkins wrote:

> The first draft updates RFC 5759, and addresses requirements for RFC 
> 5280 compliant public-key certificates and CRLs that contain or 
> reference algorithms in the CNSA suite. It is available at 
> <https://www.ietf.org/internet-drafts/draft-jenkins-cnsa-cert-crl-profile-01.txt>. 
> We would appreciate any comments you might have regarding the draft, 
> either via the mail-list or via direct reply.

This looks good on its face. However, I would argue that the reference 
[CNSA] is a normative reference: one cannot evaluate whether the 
requirements in the draft match the requirements in [CNSA] without 
reading and understanding [CNSA].

A big issue, however, is that [CNSA] points to:
    https://www.iad.gov/iad/programs/iad-initiatives/cnsa-suite.cfm
I cannot read that document on any of my browsers because the 
certificate used for TLS is invalid in current browsers, and attempting 
to switch to the HTTP version redirects to the insecure HTTPS version.

I know that this is not something that the authors can fix on their own, 
but I would strongly object to the IETF moving this document forwards as 
an RFC with a normative reference that no one can read without making 
TLS changes in their browsers. Lots of US federal agencies have HTTPS 
web sites that are readable by the general public; this should be no 
different.

--Paul Hoffman