Re: [Teep] AD review of draft-ietf-teep-architecture-15

[Benjamin Kaduk <[e-mail]>]

Hi Dave,

Thanks for the updates to this and the HTTP transport.
Everything looks good, so I'll go kick off the IETF LC (which will be
extended a week as it overlaps IETF 113).

On Tue, Mar 01, 2022 at 12:13:38AM +0000, Dave Thaler wrote:
> Ok, I've now addressed the comments on this document and will submit an update soon.  Responses with [DT] below.
[...]
> Section 9.4
> 
> 
> 
>    certificate.  Such validation includes checking for certificate
> 
>    revocation.  See Section 6 of [RFC5280] for details.
> 
> 
> 
> Might OCSP (including stapling) or other non-CRL mechanisms be in scope?  Is it worth mentioning RFC 6960 or 6961 as well as 5280 here?
> 
> 
> 
> [DT] At IETF 111, the TEEP WG got consensus to not depend on OCSP and remove such references from the protocol spec.   Meeting discussion is documented in https://datatracker.ietf.org/meeting/111/materials/minutes-111-teep-00 which says
> 
> among other things:
> 
>   *   Russ made the argument that OCSP stappling might be difficult for constrained node. He was arguing that there are more lightweight solutions.
>   *   Ben: OCSP does not really make sense with COSE. You might just be using hard-coded keys and you might be updating keys with software updates. It is probably still worth to mention that there is a need for revocation.

Haha, I guess my memory is going :)
Thanks for the reminder.

-Ben