[stir] Éric Vyncke's No Objection on draft-ietf-stir-oob-06: (with COMMENT)

[Éric Vyncke via Datatracker <[e-mail]>]

Éric Vyncke has entered the following ballot position for
draft-ietf-stir-oob-06: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-stir-oob/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for the work put into this document.

BTW, I second Mirja's question about the doc status. Else, see below for minor
COMMENTs.

Regards,

-éric

== COMMENTS ==

-- Section 4 --
It is really unclear to me how the system could work if there is no discovery
mechanisms for the CPS (even if section 10 is devoted to discovery). Else, I am
fearing having one CPS per smart phone OS or any other fragmentation...

-- Section 6 --
" transport-level security can provide confidentiality from eavesdroppers for
both the storage", while I agree that TLS provides confidentiality for
eavesdroppers, I wonder how it can protect the storage (data at rest) ? Or am I
reading the sentence incorrectly ?

-- Section 7.4 --
Should this section "Substitution Attacks" be a sub-section of section 7.3
"Security Analysis" ?

In the time diagram, it is not clear at reading the figure what CS stands for
(need to read the text below) also unclear who is initiating 'Call from CS': is
it the attacker?