[stir] Thoughts on draft-ietf-stir-cert-delegation-00

[Eric Burger <[e-mail]>]

Section 4:
Will SHAKEN certificates carry a TNAuthList? If not, we are in academic exercise land. If so, we are good. If not, should we be? If we should, is it practical?

The last three paragraphs imply to me that this is a fancy way of saying in the U.S. context the PA will allow the CA to issue signing certificates to enterprises. Is this interpretation correct? If so, does that not dramatically simplify things? An enterprise gets a signing certificate. They sign their Identity header. Since they are not a CSP entitled to put traffic on the public network, their CSP will also sign with something like the opt mechanism. Mission accomplished? Remember, a B attestation from a trusted CSP over a signed Identity is going to get much better treatment than an A attestation from The Grace L. Ferguson Robocalling and Storm Door Company <https://www.amazon.com/Grace-Ferguson-Airline-Storm-Hungry/dp/B00122NVAQ>.

Section 5:
Is the verification of the scope of the validation certificate in real-time, or can it be done administratively off-line?

Section 8, last paragraph of p. 7:
I thought RFC 2119 does not apply to non-protocol thingies, like being the protocol police and attempting to enforce a totally non-protocol policy. As such, having an RFC 3514 evil bit in the CA seems a bit odd. As the TBD offers, I’d suggest not going there.