Re: [stir] [Gen-art] Genart last call review of draft-ietf-stir-cert-delegation-03

Alissa Cooper <alissa@cooperw.in> Thu, 10 September 2020 13:33 UTC

Return-Path: <alissa@cooperw.in>
X-Original-To: stir@ietfa.amsl.com
Delivered-To: stir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E4063A0A35; Thu, 10 Sep 2020 06:33:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=cooperw.in header.b=EN/otGwp; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=bOobhUwP
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M27RfiYeKsWQ; Thu, 10 Sep 2020 06:33:13 -0700 (PDT)
Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB1413A0A2B; Thu, 10 Sep 2020 06:33:13 -0700 (PDT)
Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 3A4F85C0057; Thu, 10 Sep 2020 09:33:13 -0400 (EDT)
Received: from mailfrontend1 ([10.202.2.162]) by compute4.internal (MEProxy); Thu, 10 Sep 2020 09:33:13 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cooperw.in; h= content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; s=fm1; bh=n Swq+B6VCgMFFnYet8ZLVjRHW2yHSMfVsD2bYOIe9Rc=; b=EN/otGwpv+D9HoOHw V+pNUHwQ1hGBpWnBNXW427B1mWs9NW49OicZyvFiGcsVK4eIwL+5b6q5epCPMDwU avt5PS78MUboVlQPdGikvUNAO4spcsazvwajJjXbyztrRnQYIDMusQaO4SrKiV5+ qR27p62LhRyKaytlQTShkm6DxK0zcVwagH/8WFkIJ2AE1KWUq2T4Cy7uVughFRrG lXPKipNBQVXKUpj5a6aPktYaW7KxEf4/J9DATwgVJY0Yw2aVs9+E7K2g9fljN9dI MB+vOr3l+jR3UlUMdv6GQ5UZh7TolQkG4H5l8lVUM3DPe6sG43EMarcGLtDoKc4w ShdaQ==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm3; bh=nSwq+B6VCgMFFnYet8ZLVjRHW2yHSMfVsD2bYOIe9 Rc=; b=bOobhUwPqN9+qptMzf8BsLYtrrfG0Ino8h71y+tlDM9ibJVLUlt6b5kZs zQtgnE87oC6nmwJuG8Twy32ks6jkuayi48VLJbDZ73JFwkIVRhhf8K9K/EcsMSNu RNeoiLlcvdrkXZmgCXLOB6uriguAfZLqeoKejzTB2T6QNb3lmv4Oqo3tVx0QLBsr FI5s2nS0Ecy38fff6XwSABLJ5ndOOJPBI7EqUexrFeEmfyMkyu/xyynpdmFhIw/U wjPozcEmUn9wIippnNP/5157BSF2HRbViMk2XyAmEEI6bhI9ZRbGshdN2fuHbBV/ CWhAmLxgg8Y0988mMy1KKx+JrrBTQ==
X-ME-Sender: <xms:GStaX7xP4tVYxIYMsSUJPL65An5utigSYTZxGkS7Yc7-GN2Vxfbvbw> <xme:GStaXzT3RDYBW7HuqQR3M2lkrEmXVCdYkhtNBo88RqmBwGWaG4WlR-h0KJhLr173A xfxPSV7xfxUn33GKw>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduiedrudehjedgheelucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurheptggguffhjgffgffkfhfvofesthhqmhdthhdtvdenucfhrhhomheptehlihhs shgrucevohhophgvrhcuoegrlhhishhsrgestghoohhpvghrfidrihhnqeenucggtffrrg htthgvrhhnpefgteekteefhedthfejueehkeeiueektedtvdegffeuffejvdegieetfedt udefkeenucffohhmrghinhepihgvthhfrdhorhhgpdgrthhishdrohhrghdpnhhitggtsh htrghnuggrrhgushdrohhrghdruhhknecukfhppedujeefrdefkedruddujedrkeegnecu vehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomheprghlihhssh grsegtohhophgvrhifrdhinh
X-ME-Proxy: <xmx:GStaX1VRxgRRM6FJiifiv2Bnr48SP_2g7MiS492aJy8Qh7BnbuB3Ag> <xmx:GStaX1hrwiqHMAiC9bdNTaZr9k1Pxo-LA0-wa-MIiOmB1qp-b3JO4w> <xmx:GStaX9CInGIrdoGKrlFX12eE0scqQrdYE2kh7XHACka8fUfNfUKfFg> <xmx:GStaXwPgAaLdtcY5Q0NQbf5DKt4hrE60wyXuB_ZbZmG3Y4RnspAVcw>
Received: from rtp-alcoop-nitro2.cisco.com (unknown [173.38.117.84]) by mail.messagingengine.com (Postfix) with ESMTPA id BFF2A328005D; Thu, 10 Sep 2020 09:33:12 -0400 (EDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\))
From: Alissa Cooper <alissa@cooperw.in>
In-Reply-To: <159847741398.23291.8299604699001624244@ietfa.amsl.com>
Date: Thu, 10 Sep 2020 09:33:12 -0400
Cc: gen-art <gen-art@ietf.org>, last-call@ietf.org, draft-ietf-stir-cert-delegation.all@ietf.org, stir@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <3C4EC3E8-5345-448C-9668-672879D9AD8C@cooperw.in>
References: <159847741398.23291.8299604699001624244@ietfa.amsl.com>
To: Ines Robles <mariainesrobles@googlemail.com>
X-Mailer: Apple Mail (2.3608.120.23.2.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/stir/GaNKT5Au9WxsxR6y6bz6niAIBBI>
Subject: Re: [stir] [Gen-art] Genart last call review of draft-ietf-stir-cert-delegation-03
X-BeenThere: stir@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Secure Telephone Identity Revisited <stir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/stir>, <mailto:stir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/stir/>
List-Post: <mailto:stir@ietf.org>
List-Help: <mailto:stir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/stir>, <mailto:stir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Sep 2020 13:33:16 -0000

Thanks Ines. I entered a No Objection ballot.

Alissa


> On Aug 26, 2020, at 5:30 PM, Ines Robles via Datatracker <noreply@ietf.org> wrote:
> 
> Reviewer: Ines Robles
> Review result: Ready with Issues
> 
> I am the assigned Gen-ART reviewer for this draft. The General Area
> Review Team (Gen-ART) reviews all IETF documents being processed
> by the IESG for the IETF Chair.  Please treat these comments just
> like any other last call comments.
> 
> For more information, please see the FAQ at
> 
> <https://trac.ietf.org/trac/gen/wiki/GenArtfaq>.
> 
> Document: draft-ietf-stir-cert-delegation-03
> Reviewer: Ines Robles
> Review Date: 2020-08-26
> IETF LC End Date: 2020-08-26
> IESG Telechat date: Not scheduled for a telechat
> 
> Summary:
> 
> This specification details how that authority can be delegated from a parent
> certificate to a subordinate certificate.  This supports a  number of use cases
> where callers want to use a particular calling number, but for whatever reason,
> their outbound calls will not pass through the authentication service of the
> service provider that controls that numbering resource, it includes also those
> where service providers grant credentials to enterprises or other customers
> capable of signing calls with Secure Telephone Identity Revisited (STIR).
> 
> I have some minor suggestions/questions to the authors.
> 
> Major issues: None
> 
> Minor issues:
> 
> 1-Introduction Section:
> 
> "..., including various forms of robocalling, voicemail hacking, and
> swatting..." --> should a reference to RFC7375 be added here?
> 
> 2- It would be nice to add in Terminology section:
> 
> -  delegation: the concept of delegation and its levels are defined in RFC8226.
> - definition for "legitimate spoofing". I understand that the draft explain it
> with an example.
> 
> 3- It would be nice to add references to concepts, e.g. cA boolean --> cA
> boolean [rfc5280#section-4.2.1.9]
> 
> "x5u" link -> "x5u" (X.509 URL) [RFC7515#section-4.1.5] link
> 
> 4- Section 4: It would be nice to add graphics explaining the process.
> E.g. can be used as a model the images displayed in
> https://access.atis.org/apps/group_public/download.php/47134/IPNNI-2019-00043R000.pdf
> or https://niccstandards.org.uk/wp-content/uploads/2019/03/ND1522V1.1.1.pdf
> 
> 5- Section 5:"Authentication service behavior for delegate certificates is
> little
>   changed from [RFC8224] STIR behavior" --> It is not clear to me what are the
>   little changes.
> 
> Additionally, how you quantify little/big changes?, maybe something like?:
> "Authentication service behavior varies from STIR behavior [RFC8224] as
> follows:...."
> 
> 6- Section 8.1: Should the picture displayed in
> https://www.ietf.org/proceedings/104/slides/slides-104-stir-certificate-delegation-00--Slide
> 5 be added here?
> 
> 7- Security Consideration section: should a reference to RFC7375 be added here?
> 
> Nits/editorial comments:
> 
> 8- Expand the first time: JWS -> JSON Web Signature (JWS)
> 
> Thank you for this document,
> 
> Ines.
> 
> 
> 
> _______________________________________________
> Gen-art mailing list
> Gen-art@ietf.org
> https://www.ietf.org/mailman/listinfo/gen-art