[stir] Pay Attention (was Re: Robert Wilton's No Objection on draft-ietf-stir-enhance-rfc8226-03: (with COMMENT))

[Robert Sparks <[e-mail]>]

STIR WG - There's a small bit of normative text that is going into this 
document based on IESG discussion - you've already seen it on list, but 
I've copied it here for your convenience. I want to make sure you don't 
miss it (fwiw, I'm fine with it). If anyone has problems with it, reply 
very soon.

RjS

On 6/28/21 1:30 PM, Russ Housley wrote:
> Rob:
>
>> ----------------------------------------------------------------------
>> COMMENT:
>> ----------------------------------------------------------------------
>>
>> Hi,
>>
>> Thanks for the document, despite not being my area of expertise I found it easy
>> to read and understand.
>>
>> A couple of minor comments:
>>
>> (1) Like Erik, when reading section 4, I was wondering whether it would be
>> helpful to have an example that included both mustInclude and permittedValues.
>> But of course, I note that you effectively do that in section 5.
> I hope the change proposed to resolve Erik's comment is also sufficient to resolve your comment.
>
>> (2) In the security section, it states:
>>
>>    Certificate issuers should not include an entry in mustExclude for
>>    the "rcdi" claim for a certificate that will be used with the
>>    PASSporT Extension for Rich Call Data defined in
>>    [I-D.ietf-stir-passport-rcd].  Excluding this claim would prevent the
>>    integrity protection mechanism from working properly.
>>
>> I was wondering whether it would be helpful to include this as RFC 2119 SHOULD
>> NOT in 3, or perhaps have a forward reference from the section 3 description of
>> mustExclude to the "rcdi" consideration in the security section.
> Sure:
>
>     Certificate issuers SHOULD NOT include an entry in mustExclude for
>     the "rcdi" claim for a certificate that will be used with the
>     PASSporT Extension for Rich Call Data defined in
>     [I-D.ietf-stir-passport-rcd].  Excluding this claim would prevent the
>     integrity protection mechanism from working properly.
>
> Russ
>