[stir] Quick look at draft-peterson-stir-certificates-shortlived-05

[Eric Rescorla <[e-mail]>]

Document: draft-peterson-stir-certificates-shortlived-05.txt

This seems like a reasonable idea, thought it should probably
be clearer why it needs a new spec. It seems like that
is because 8224 requires x5u, not x5c? If so, perhaps that
should be made clear as the normative change.


   As an optimization, this specification permits the conveyance of the
   certificate chain for a short-lived certificate via the "x5c" JWS
   header element ([RFC7515] Section 4.1.6).  The "x5c" element contains
   a base64 encoded DER representation of the certificate chain.  STIR
   Verification service implementations compliant with this
   specification MUST support the "x5c" element; authentication services
   SHOULD use the "x5c" format for PASSporTs signed by certificates with
   an expiry shorter than one week.  The presence of x5y creates

x5c, right?


   PASSporT objects that are considerable larger than typical RFC8225
   tokens, and the longer the certificate chain, the larger the PASSporT
   header will be.  But provided the certificate chain leads to a
   trusted certification authority, "x5u" precludes the need for a
   round-trip time before validation at the STIR verification service.

Depending on what you are trying to say, this may also be
"x5c". If it's "x5u", then you should clarify the text.