[stir] Re: WG Last Call: draft-ietf-stir-certificate-transparency-01 (Ends 2025-12-15)

[Chris Wendt <[e-mail]>]

Hi Simon,

Appreciate your comments, responses inline below:

> On Dec 12, 2025, at 11:22 AM, Simon Castle <[e-mail]> wrote:
> 
> Hi,
> 
> I have the following suggestions and questions for this proposal:
> 
> General - Should the reference point for this be RFC 6962 or 9162?  I believe the latter is not yet in common usage but given that any implementation of this standard for STIR certificates is future looking, is there a reason not to take the updates implemented in 9162 as a baseline?

As referenced by Russ, there was an extensive working group discussion on this topic and the overwhelming decision was to stick with RFC6962 since it is the form of certificate transparency used in the industry today.

> 
> Section 7.2.2: Verification Service Processing - This uses the term "DC public key" and "DC chain" without clarifying "DC".  I assume this is intended to mean Delegate Certificate (given that is listed in Section 4.3, but the abbreviation is not introduced then) but if this is correct, I don't understand why this section references delegates specifically - I believe the rest of the document covers all STIR signing certificates, so the verification process should apply to both delegates and non-delegates.  Could this be clarified?
> 
> (Minor grammatical/formatting point) Section 8 - The bullets in this section should be split onto multiple lines instead of one combined line.

Thank you for pointing these out, (yes DC == Delegate Certificate) we can definitely make sure to fix these and clarify in the next update.

I’ll ask the @chairs if that is something we should update now or it’s good enough to wait for during the IETF review process.  Happy to do it either way.

-Chris

> 
> Thanks,
> Simon
> 
> 
> -----Original Message-----
> From: Ben Campbell via Datatracker <[e-mail]> 
> Sent: 01 December 2025 21:58
> To: [e-mail]; [e-mail]; [e-mail]
> Subject: [stir] WG Last Call: draft-ietf-stir-certificate-transparency-01 (Ends 2025-12-15)
> 
> 
> Subject: WG Last Call: draft-ietf-stir-certificate-transparency-01 (Ends
> 2025-12-15)
> 
> This message starts a 2-week WG Last Call for this document.
> 
> Abstract:
>   This document describes a framework for the use of the Certificate
>   Transparency (CT) protocol for publicly logging the existence of
>   Secure Telephone Identity (STI) certificates as they are issued or
>   observed.  This allows any interested party that is part of the STI
>   eco-system to audit STI certification authority (CA) activity and
>   audit both the issuance of suspect certificates and the certificate
>   logs themselves.  The intent is for the establishment of a level of
>   trust in the STI eco-system that depends on the verification of
>   telephone numbers requiring and refusing to honor STI certificates
>   that do not appear in a established log.  This effectively
>   establishes the precedent that STI CAs must add all issued
>   certificates to the logs and thus establishes unique association of
>   STI certificates to an authorized provider or assignee of a telephone
>   number resource.  The primary role of CT in the STI ecosystem is for
>   verifiable trust in the avoidance of issuance of unauthorized
>   duplicate telephone number level delegate certificates or provider
>   level certificates.  This provides a robust auditable mechanism for
>   the detection of unauthorized creation of certificate credentials for
>   illegitimate spoofing of telephone numbers or service provider codes
>   (SPC).
> 
>   The framework borrows the log structure and API model from RFC6962 to
>   enable public auditing and verifiability of certificate issuance.
>   While the foundational mechanisms for log operation, Merkle Tree
>   construction, and Signed Certificate Timestamps (SCTs) are aligned
>   with RFC6962, this document contextualizes their application in the
>   STIR eco-system, focusing on verifiable control over telephone number
>   or service provider code resources.
> 
> File can be retrieved from:
> https://datatracker.ietf.org/doc/draft-ietf-stir-certificate-transparency/
> 
> Please review and indicate your support or objection to proceed with the publication of this document by replying to this email keeping [e-mail] in copy. Objections should be motivated and suggestions to resolve them are highly appreciated.
> 
> Authors, and WG participants in general, are reminded again of the Intellectual Property Rights (IPR) disclosure obligations described in BCP 79 [1]. Appropriate IPR disclosures required for full conformance with the provisions of BCP 78 [1] and BCP 79 [2] must be filed, if you are aware of any. Sanctions available for application to violators of IETF IPR Policy can be found at [3].
> 
> Thank you.
> 
> [1] https://datatracker.ietf.org/doc/bcp78/
> [2] https://datatracker.ietf.org/doc/bcp79/
> [3] https://datatracker.ietf.org/doc/rfc6701/
> 
> 
> 
> _______________________________________________
> stir mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> _______________________________________________
> stir mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]