[stir] Re: draft-ietf-stir-certificates-ocsp-11 ietf last call Secdir review

["Peterson, Jon" <[e-mail]>]

Thanks for the read, PHB. I’ve added some text to the -12 that fleshes out the Sec Cons along the lines you recommended.

Jon Peterson
TransUnion

From: Phillip Hallam-Baker via Datatracker <[e-mail]>
Date: Sunday, August 3, 2025 at 12:55 PM
To: [e-mail] <[e-mail]>
Cc: [e-mail] <[e-mail]>, [e-mail] <[e-mail]>, [e-mail] <[e-mail]>
Subject: draft-ietf-stir-certificates-ocsp-11 ietf last call Secdir review

This Message Originated from Outside of the Organization
Do not click links or open attachments unless you can confirm the sender and know the content is safe.
Report Suspicious<https://us-phishalarm-ewt.proofpoint.com/EWT/v1/GX53klZ1TQ0!YsOkliH5lxSFha_IwK_vTLPYhVfl0Tg8DVJBPXtaFlrD4aEmTHd6vX1TpGzeYhuL_yboSnRyOHjWtDcyNL1Pm_B5V9zNRubr3SQ4Qk_Y7SG1JEkOItQS2kSjTDh3Krt_o_5pYbE$>


Document: draft-ietf-stir-certificates-ocsp
Title: OCSP Usage for Secure Telephone Identity Certificates
Reviewer: Phillip Hallam-Baker
Review result: Has Issues

The Security Considerations section needs to be more than just
'this document is all about security'.

The privacy considerations section needs to be cited as the information
relating to certificate (and hence subscriber activity) leaking is also a
security consideration. Operators of the OCSP services need to take appropriate
measures.

Another dimension that needs to be considered is service. The loss of the OCSP
service potentially results in a subscriber being unable to place or receive a
call. The OSCP service may be a target for a DoS attack. While stapling
mitigates this, it does not eliminate it.