[stir] AD Evaluation: draft-ietf-stir-passport-rcd

["Murray S. Kucherawy" <[e-mail]>]

Hi all, here are my review comments for this document.  Thanks for the work
put into it.

-MSK

General:

I found several places where "indexes" was used instead of "indices".

How do we know that the reason placed in a "crn" claim is true?  Could this
be abused?  If so, should this be called out in Section 13 or 18 (or
somewhere else)?

Section 1:

The last sentence of the third paragraph, namely "However, both are ...,
and therefore is ...", is a bit hard for me to parse.

In the fourth paragraph, "In" has been reduced to "n".

Section 3:

* The last sentence of the first paragraph could use some commas, usually
right before each "or".

* "P-Asserted-ID" should be "P-Asserted-Identity".

Section 4:

* "Often there is policy and restrictions ..." -- s/is/are/

* "(Auth represents authoritative in this table)" -- I suggest quoting
"Auth" and "authoritative", and adding a period after "table".

Section 5.1.3:

* "... the call-info header field ..." -- s/call-info/Call-Info/

Section 6:

The last paragraph describes the syntax of the values in this claim.  It
says there is a delimiter in the value, namely a "minus" character.  I know
what that means but I've never heard that character identified that way;
it's usually "dash" or "hyphen".  In this era of Unicode, might it be
better to identify it as ASCII 45?

For that matter, would ABNF be useful here?

Section 8.1:

The "must" in here probably needs to be a "MUST".

Section 13:

* "Even in first party cases, this admits of some complexity: ..." -- I
don't understand the part after the comma; should "of" be dropped?

Section 14.1:

"Identity header" should be "Identity header field" (at least two
instances).

Section 14.2:

The "SHOULD" presents an implementer with a choice, but includes no
guidance about how to make that choice.  I suggest adding some, or
reconsidering whether SHOULD is appropriate here.

Section 17.2:

There isn't a registry called "PASSporT Types".  I only see "Personal
Assertion Token (PASSporT) Extensions" and "PASSporT Resource Priority
Header (rph) Types".  Which one are we modifying here?

Section 17.3:

This should say that the new registry should be added to the "Personal
Assertion Token (PASSporT)" group.

A "Specification Required" registry will require nomination of one or more
Designated Experts.  Do you have anyone to nominate?  Moreover, Section 4.6
of BCP 26 says you should provide guidance to the DE to be applied to new
registrations once the registry is created.  That seems to be missing here.

You should also specify explicitly that new registrations consist only of a
name and a reference document.

Section 18:

I can't parse the first sentence of this section.