Re: [stir] WG Last Call comments on stir-oob-04

["Peterson, Jon" <[e-mail]>]

Thanks for the notes Russ. A few responses inline.
    
    Major:
    
    Title page: As discussed on the mail list, please change the 
    intended status to "Informational".
    
    Section 11: To date, STIR certificates are only used to digital
    signature.  This document suggests that the public key in the
    certificate can also be used to provide confidentiality.  This
    works if the public key is RSA, and the certificate has the
    appropriate key usage bits set.  However, this does not work if
    the public key is DSA, ECDSA, Ed25519, or several others.  I
    am not asking for a major change to the document, but this
    should be pointed out in the document.  

<Jon>This is an artifact of how long the document has been in progress - since before we moved STIR to ECDSA. So, good catch. I do think we should at least sketch a plausible way to get those encryption keys into the architecture. We'll circle around on that and come back with something. </Jon>

    And, Section 11 should
    point out that finding the credential for the callee cannot
    leverage the "x5u" claim in the PASSporT when the public key
    can only be used for digital signature.
    
<Jon> I'd like to keep the x5u semantics the same in OOB as in-band, definitely, so some change to the text is needed there, agreed. </Jon>
    
    Minor:
    
    Section 2: Please update the first paragraph to reference RFC 8174
    in addition to RFC 2119, as follows: 
    
       The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
       "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
       "OPTIONAL" in this document are to be interpreted as described in
       BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
       capitals, as shown here.
       
    Of course, also add a reference to RFC 8174.

<Jon> Will do. </Jon>
    
    The figure in Section 7.2 can be easily adjusted to fit the normal
    margins.  Also, the example telephone numbers should use the 555
    conventions.  I suggest:
    
       Alice                    Call Placement Service                  Bob
       --------------------------------------------------------------------
    
       Store PASSporT for 2.222.555.2222 -->
    
       Call from 1.111.555.1111 ------------------------------------------>
    
    
                                        <-------------- Request PASSporT(s)
                                                         for 2.222.555.2222
    
                                        Obtain Encrypted PASSporT -------->
                                        (2.222.555.2222, 1.111.555.1111)
    
                                                  [Ring phone with callerid
                                                          = 1.111.555.1111]
    
    Also, adjust the text to reference these example telephone numbers.
    
    Likewise, please adjust the example telephone numbers in Section 9.
    
    It should be equally easy to remove three spaces from the figure in
    Section 7.4 to fit the normal margins.

<Jon> Will fix various margins. The numbers are illegal ones, just illegal in a different way than usual. </Jon>
    
    Section 7.3: Please add a reference for TLS.  I assume you will use
    [RFC8446].
    
    Section 7.5: s/Sign(K_cps, K_temp))/Sign(K_cps, K_temp)/
    
    Section 11: Please add a reference for OCSP.  I assume you will use
    [RFC2560].

<Jon> Will fix those. </Jon>
    
    Section 14: I think it would be helpful to include pointers to
    Sections 7.3 and 7.4 in the Security Considerations.

<Jon>Yes, I am convinced we need some better Sec Cons text here. And as to nits below, will fix those, thanks. </Jon>
    
    Nits:
    
    Suggested spelling: s/CPSs/CPSes/  (Note: This spelling is used for
    Certificate Practice Statements.)
    
    Section 3: Please spell out the first use of "POTS".  As an alternative,
    the sentence could be reworded to use PSTN, which has already been used
    many times by this point in the document.
    
    Sections 5.1 and 5.4: s/in the SIP world/in a SIP environment/
    
    Section 5.4: s/back to the IP world/back to a SIP environment/
    
    Section 5.4: s/returns to the IP world/returns to a SIP environment/
    
    Section 5.5: s/a valid calls/a valid call/
    
    Section 6.2: s/one that is valid/one or more that are valid/
    
    Section 7.5: Please add an informative reference on blinded signatures.
    
Jon Peterson
Neustar, Inc.