[stir] Review of draft-ietf-stir-passport-09

[Eric Rescorla <[e-mail]>]

OVERALL
This document would be easier to read if it came with an example
at the beginning (perhaps the one in 9.1).

I've also been thinking about the use of a URL here. This has
the result that it doesn't bind the certificate itself into the
digital signature, but only the URL. So this implies that it's
at least potentially possible to substitute one certificate
for another with the same private key. Is that a concern here?


S 4.3.
Certificate chains are generally self-validating, so can you explain
why you need HTTPS here? Clearly, it's good practice for confidentiality
and to prevent other forms of attack, but still.


S 5.2.
   {
   "dest":{
          "tn":["12125551212"],
              "uri":["sip:[e-mail]",
                  "sip:[e-mail]"]
          },
          "iat":"1443208345",
          "orig":{"tn":"12155551212"}
      }

This indentation seems weird. Should you be outdenting the "uri" line.

S 5.2.2.
Given the ambiguity about multiple fingerprints, you should probably
cite the 4572-bis draft.


S 7.
    The using protocol of the compact form of PASSporT MUST

This "using protocol" language is pretty odd. Maybe define a specific
term somewhere else? "application protocol"?

S 9.
   JSON, as a canonical format, can include spaces and line breaks, and
   key value pairs can occur in any order.

Doesn't this mean that JSON isn't canonical?


S A.1, A.2

These aren't actually X.509 structure. Also, the private key in S 8.1
is in an OpenSSL-specific structure. Could you encode it in PKCS#8.