I do not believe that this document is ready for submission to the IESG. Some issues still remain with this document, as listed below.
Geoff On 06/03/2010, at 9:05 AM, Sandra Murphy wrote: > The authors of Certificate Policy (CP) for the Resource PKI (RPKI) have > submitted a new version in accordance with comments received in the last call > (http://tools.ietf.org/html/draft-ietf-sidr-cp-08). > > I am opening a last call on this document for one week, ending Friday, March > 12. > > Note that comments on this revision are restricted to whether the issues have > been adequately addressed. > 1. Introduction, para 1 - is the use of the verb "will" normative (i.e. MUST), or intentional "SHOULD" or optional" "MAY". I'd like to see the second sentence changed to say "MAY" or if that is not acceptable, to say "may" 2. Introduction, para 1 - third sentence - is this "will" more accurately a "can" 3. Introduction, para1, third sentence - "uniqueness" is not an outcome of verification of a certificate. It would be more accurate to drop "uniqueness" from this assertion. 4. section 1.2, para 1. The same assertion is made that associated certification with uniqueness. The constraint on an address issuer that creates a unique distribution of resources is not an intrinsic attribute of certification of the issuance. 5. section 1.4.1 - the document appears to preclude the actions of LIRs / ISPS in distributing AS numbers. I do not believe that this is appropriate, nor accurate, in today's environment 6. section 2.2 - is a CA responsible for publishing ALL certifications it issues, or can it be selective in publication? The section is unclear on this 7. section 2.2 - a similar question is raised regarding CRLs and RPKI-signed objects. Is the CA requires to publish ALL such issued objects? 8 section 2.3 - the document does not specify a CA's actions regarding the publication of expired and revoked certifications, nor indicate of the CA's CPS should include such information. 9. section 2.4 - is the "shall" here a "SHALL" in a normative sense or a "MAY"? 10. section 3.2.1 - is this "will require" a MUST require or a SHOULD require? 11. section 3.2.2 - is this "will" a MUST, SHOULD or a MAY? 12. section 3.2.3 - is this "will" a MUST, SHOULD or a MAY? 13. section 3.2.5 - is this "will" a MUST, SHOULD or a MAY? - This occurs in subsequent sections that describe actions of the CA, and the use of normative language in describing these CA actions is recommended. These instances are not further flagged here,. 14. sections 3.2 and 3.2 - I am not sure that these need to be separate - for example is issuance after revocation any different from initial issuance - i.e. the same criteria of 3.2.1, 3.2.2, 3.2.3 and 3.2.5 apply, so why is 3.3.2 called out - what new information is being provided here that is not already provided in the previous section? 15. section 3.4 - why does this section of the text NOT refer to the actions of a CA as described in sections 3.2.1, 3.2.2, 3.2.3 and 3.2.5? It appears that revocation is described in more informal terms and issuance, yet the constraints on the CA to ensure that authenticity of the request are intended to be the same. 16. section 4.1.1 - normative language required - the "should" referred to here is unclear. Subsequent sections also use "should" where normative language would be clearer. 17. section 4.5.2 - this section refers to "all the CAs in the chain that issued the certificates relevant to the certificate in question" without further clarification or explanation. In the light of related work on local TA generation I am left with the question of what exactly is being referred to here in this "chain"./ I would prefer this term to be defined. 18. section 4.8 - why is the treatment of augmentation of a subject's INRs treated differently to reduction in a subject's INRs? While section 4.8 deals with the steps involved in issuing a new certification in the case where a subject's INR's are augmented, there is no corresponding description of the process in reduction, other that the single sentence in section 4.8.1 that does not refer to any other part of the CPS. 19 section 4.10 - is it truye to say that "This PKI does not make use of OCSP or SCVP" or is it more appropriate to state that "RPs SHOULD NOT rely on the use of OCSP or SCVP"? 20 - section 5.8 "The termination of a CA shall therefore be subject to the agreement between the issuer and the subscriber and will be described in the CPS for the issuer." I am finding it difficult to reconcile this need for "an agreement" in the light of the observation that where a CA no longer has any INR resources then it cannot function as a CA in the RPKI, whether or not an agreement is reached, Why then is an agreement stipulated here? Style comment: Is the use of double ' chars instead of a " or ' char deliberate? For example, I would've expected to see " marks in section 1.3 when describing the name of the document, and thereafter when denoting the use of particular terms. _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
