Re: [stir] [Acme] Authority Token WGLC

Sean Turner <sean@sn3rd.com> Wed, 07 September 2022 02:40 UTC

Return-Path: <sean@sn3rd.com>
X-Original-To: stir@ietfa.amsl.com
Delivered-To: stir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 411A5C14F74C for <stir@ietfa.amsl.com>; Tue, 6 Sep 2022 19:40:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.106
X-Spam-Level:
X-Spam-Status: No, score=-2.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JJs_vjvCXBjB for <stir@ietfa.amsl.com>; Tue, 6 Sep 2022 19:40:05 -0700 (PDT)
Received: from mail-qv1-xf2f.google.com (mail-qv1-xf2f.google.com [IPv6:2607:f8b0:4864:20::f2f]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B2E33C14CF17 for <stir@ietf.org>; Tue, 6 Sep 2022 19:40:05 -0700 (PDT)
Received: by mail-qv1-xf2f.google.com with SMTP id l5so9690944qvs.13 for <stir@ietf.org>; Tue, 06 Sep 2022 19:40:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:from:to:cc:subject:date; bh=6sYeQZkgneIj7sb6uWiGyQTlxGvWWTJkqIMI0XeQs7A=; b=Lv5ETzCNHGjwR5E4ogFveO45fESb+3wVSQFE+IvR+yiy+HTqFEFVbOE9C+0pq1Et5t s6yRb+Rm2JQWuzpb3Ub+e7KqGgb2yx0iHybYGEQ4oOCp53+ovqEgD0g0G9W9jChFtjvL Q1htQ/paOD6/WprD7Zw+oOCG+qKUVdGOGZ5XE=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:x-gm-message-state:from:to:cc :subject:date; bh=6sYeQZkgneIj7sb6uWiGyQTlxGvWWTJkqIMI0XeQs7A=; b=5E7n8HBcdy5caJVVIrLGCJvqrhdMamlUA43hib0eogdkoO/etE03s30ZIVH5WP176F a4ssOA/NXLR1VtlaftsGPAWsZsNI8Sw8c5Lw+lM9k/NZg1nXRuyrRgBQRFRVNfoel38Q n4RhXEJT34Bf0JvlTUVbqbm/Du+3tPL8I+ywULDg26cJ9oL7K7sxnvrGIFG35E0YciqE zSU5dQ9v4tZLm4EMx7jjf85P+iB/gLMuruRAFNr4VAApowTAHKp1uPa5eTkVHkX0Vt4t zz7MDlnx7NVZEfOaJKlrRbEfa/QZIlT4dl2xgWh1gLrvBRx7zhgJFOjfIxcBr2h4l4UG 7rBQ==
X-Gm-Message-State: ACgBeo3ZPx+RtE+q1ojmS5TCYvlnhnAYsZjP0MV8dH0pHvfe6WuzEIzK x0nFNJ4poIFMNeJGpJR0fXcLGQ==
X-Google-Smtp-Source: AA6agR5qOJ/IJdEOi+TFjwMqLUzAo6yCF5hYORM0CKCBjWKyDtbHHBGeZPY9oSGtal2KXvQ11FyeJg==
X-Received: by 2002:a05:6214:5299:b0:47e:89e9:e27b with SMTP id kj25-20020a056214529900b0047e89e9e27bmr1400527qvb.52.1662518404320; Tue, 06 Sep 2022 19:40:04 -0700 (PDT)
Received: from smtpclient.apple ([2600:4040:253b:7300:f0a6:4ce:1f4b:3bbc]) by smtp.gmail.com with ESMTPSA id g16-20020a05620a40d000b006b93b61bc74sm13611095qko.9.2022.09.06.19.40.03 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 06 Sep 2022 19:40:03 -0700 (PDT)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.120.0.1.13\))
From: Sean Turner <sean@sn3rd.com>
In-Reply-To: <CAGgd1OdkZqqHEsAXL9CpucXop8Qbr5uzknU9Onr5Sj0u_9azzQ@mail.gmail.com>
Date: Tue, 06 Sep 2022 22:40:00 -0400
Cc: draft-ietf-acme-authority-token-tnauthlist@ietf.org, stir@ietf.org, draft-ietf-acme-authority-token@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <116186D9-ECB6-40AA-B63E-291BF00175E0@sn3rd.com>
References: <CAGgd1OdkZqqHEsAXL9CpucXop8Qbr5uzknU9Onr5Sj0u_9azzQ@mail.gmail.com>
To: IETF ACME <acme@ietf.org>
X-Mailer: Apple Mail (2.3654.120.0.1.13)
Archived-At: <https://mailarchive.ietf.org/arch/msg/stir/t6_ll5qsnSym3ecLn-DCeAcpIoo>
Subject: Re: [stir] [Acme] Authority Token WGLC
X-BeenThere: stir@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Secure Telephone Identity Revisited <stir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/stir>, <mailto:stir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/stir/>
List-Post: <mailto:stir@ietf.org>
List-Help: <mailto:stir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/stir>, <mailto:stir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 07 Sep 2022 02:40:10 -0000

Hi! 

I had a read of these two I-Ds. Comments follow:

# -authority-token

tl;dr: editorial and nits

0) s8: I-D Nits complains about "Authority Tokens SHOULD not”. So s/SHOULD not/SHOULD NOT

1) s9.1: I-D Nits complains about dancing references to RFCs 3986 and 4648. I guess you could work them in, but if not then just drop them.

2) s3: Expand CAs on first use: s/CAs/Certification Authorities (CAs)

3) s3.1: Consider adding a reference to 8126, where Specification Required is defined:

s/The IANA will maintain a registry of tkauth-types under a policy of Specification Required./The IANA will maintain a registry of tkauth-types under a policy of Specification Required [RFC8126].

4) s3.1: Wording tweak - requirements just kind of hangs there:

s/In order to register a new tkauth-type, specifications must address the following requirements; in cases where a tkauth-type admits of its own subtypes, subtypes inherit these requirements./s/In order to register a new tkauth-type, specifications must address the requirements in this section; in cases where a tkauth-type admits of its own subtypes, subtypes inherit these requirements.

5) s.3.1: 2119 it:

s/Therefore, in defining tkauth-types, future specifications must indicate/Therefore, in defining tkauth-types, future specifications MUST indicate

6) s8: 2119 it:

s/ … HTTPS REST client and the Token Authority must also exist …
/… HTTPS REST client and the Token Authority MUST also exist …

s/Implementations should follow the best practices identified in [RFC8725].
/Implementations SHOULD follow the best practices identified in [RFC8725].

7) s8: dangling )

s/Section 4)./Section 4.

8) s8: algorithms for keys:

s/permit other keys/permit other algorithms
s/define new keys/define new algorithms


# -authority-token-tnnauthlist

(note I also did the ARTART review)

tl;dr: looks like -09 fixed my ARTART review comments and now I have but one new nit:

1) algorithms for keys:

s/permit other keys/permit other algorithms
s/define new keys/define new algorithms

Cheers,
spt

> On Aug 23, 2022, at 15:58, Deb Cooley <debcooley1@gmail.com> wrote:
> 
> As we agreed at the acme session at IETF 114, this is a limited WGLC for both:
> 
> https://datatracker.ietf.org/doc/draft-ietf-acme-authority-token/
> https://datatracker.ietf.org/doc/draft-ietf-acme-authority-token-tnauthlist/
> 
> I've added stir to the to line for good measure (and to broaden the pool of reviewers a bit). We need to see if we can push these forward again.  
> 
> The review deadline is 6 Sep 2022.  
> 
> Deb Cooley
> acme co-chair
> 
> _______________________________________________
> Acme mailing list
> Acme@ietf.org
> https://www.ietf.org/mailman/listinfo/acme