[stir] Roman Danyliw's No Objection on draft-ietf-stir-cert-delegation-03: (with COMMENT)

[Roman Danyliw via Datatracker <[e-mail]>]

Roman Danyliw has entered the following ballot position for
draft-ietf-stir-cert-delegation-03: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-stir-cert-delegation/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I support Ben Kaduk’s DISCUSS positions.

** Given that this document specifies the delegation model alluded to in
Section 5 of RFC8226 with normative guidance, is there a reason it doesn’t
formally update RFC8226?

** Section 4. Should this guidance be a normative MUST: “… each delegate
certificate _must_ have a TNAuthList scope that is equal to …”

** Section 4.  Should this guidance use a normative MAY: “… Delegate
certificates _may_ also contain a basic constraints extensions with the cA
boolean …”

** Section 4.1.  Per the inheritance described in: “STIR certificates may have
a TNAuthList containing one or more SPCs, one or more telephone number ranges,
or both.  When delegating from a STIR certificate, a child certificate may
inherit from its parent either of the above”, can a parent certificate specify
a SPC and the child certificate have a telephone number range; or is the
delegation only of the same types?

** Section 4.*.  Can you please clarify the use of the AIA extension in
delegation as posed by the SECDIR reviewer (thanks to Carl Wallance for doing
the review!).  Additionally, can AIA be used in delegated certificates?

** Section 7.  With regard to the use of “x5u” vs. “x5c”, what is the normative
guidance on these elements?

** Section 8.1. Per “Service providers that want the capability to rapidly
revoke delegated certificates can rely on the ACME STAR [I-D.ietf-acme-star] 
mechanism”, please clarify this text.  The intent is correct, but ACME STAR
doesn’t actually revoke certificates.

** Editorial Nits:
-- Section 5.  This text doesn’t parse “… and if that certificate has a own
parent …”

-- Section 7.  Typo. s/certificate path are/certificates paths are/