[stir] Please review of the changes in draft-ietf-stir-certificates-12

[Russ Housley <[e-mail]>]

Dear STIR WG:


> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Secure Telephone Identity Revisited of the IETF.
> 
>        Title           : Secure Telephone Identity Credentials: Certificates
>        Authors         : Jon Peterson
>                          Sean Turner
> 	Filename        : draft-ietf-stir-certificates-12.txt
> 	Pages           : 20
> 	Date            : 2017-03-13
> 
> Abstract:
>   In order to prevent the impersonation of telephone numbers on the
>   Internet, some kind of credential system needs to exist that
>   cryptographically asserts authority over telephone numbers.  This
>   document describes the use of certificates in establishing authority
>   over telephone numbers, as a component of a broader architecture for
>   managing telephone numbers as identities in protocols like SIP.

Section 8 was essentially rewritten to address the DISCUSS ballot position raised by Alexey, which said:

   Discuss (2016-11-01 for -11)

   I have one small issue that I would like to discuss before recommending approval of this document:

   Reading Section 8 I was unable to figure out what are "claim", "permitted" and "excluded" and what exact syntaxes they use. I think this is underspecified.
   You are probably missing some references, examples or both.

Part of the resolution was to simplify the constraint syntax by removing the excluded claim values.  This changes the limits that a certificate issuer might want to impose on a subordinate.

Also, Section 9 includes a small but significant change.  The SPID value in TNEntry was changed allow any service provider code, including OCNs and SPIDs.

Please review the new text in Section 8 and the change in Section 9.  Please make loud noises now if either of them causes any concern.

Russ