Re: [stir] Benjamin Kaduk's Discuss on draft-ietf-stir-enhance-rfc8226-03: (with DISCUSS and COMMENT)

[Benjamin Kaduk <[e-mail]>]

Hi Russ,

Trimming the bits that look good...

On Tue, Jun 29, 2021 at 11:22:04AM -0400, Russ Housley wrote:
> Ben:
> 
> Turning to the comments ...
> 
> > ----------------------------------------------------------------------
> > COMMENT:
> > ----------------------------------------------------------------------
[...]
> > Section 7
[...]
> >   Certificate issuers should not include an entry in mustExclude for
> >   the "rcdi" claim for a certificate that will be used with the
> >   PASSporT Extension for Rich Call Data defined in
> >   [I-D.ietf-stir-passport-rcd].  Excluding this claim would prevent the
> >   integrity protection mechanism from working properly.
> > 
> > I'd consider prefacing this paragraph with something like "For example",
> > as otherwise one might wonder why this particular claim is so important
> > to call out in this document's security considerations.
> 
> Rob asked for SHOULD NOT.  And if you look at the structure in [I-D.ietf-stir-passport-rcd], the integrity really does depend on this claim.

Yes, it's clear that the integrity of RCD does depend on the claim in
question.
It's less clear that enhance-rfc8226 is the best place to make that
restriction, which could also be imposed by draft-ietf-stir-passport-rcd
itself.  In short, "why is this claim so important that it gets called out
by name in an otherwise generic specification?".

What's in the document now is factually correct, so I don't mind having it
there; it just seems a little surprising to call out one specific external
claim and not say why only that one is mentioned.

Thanks again for all the updates,

Ben