Subject: [CDNi] Éric Vyncke's Discuss on draft-ietf-cdni-uri-signing-21: (with DISCUSS and COMMENT)

From: Éric Vyncke via Datatracker <[email-masked]>
Date: Tue, 23 Feb 2021 05:50:08 -0800

Éric Vyncke has entered the following ballot position for
draft-ietf-cdni-uri-signing-21: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Thank you for the work put into this document.

Special thanks for the doc shepherd write-up , which was really useful about
the WG history.

Please find below one blocking DISCUSS points (which should be solved easily),
one non-blocking COMMENT point (but replies would be appreciated), and some
nits.

I hope that this helps to improve the document,

Regards,

-éric

== DISCUSS ==

-- Section 2.1.10 --
About "Client IP (cdniip) claim", I really wonder whether this could be used in
real life as some IPv4 Carrier-Grade NAT (CGN) have a large pool of "public"
IPv4 addresses that could select different public IPv4 addresses if badly
designed. How will it work with dual-stack UAs where some connections could be
over IPv4 and some over IPv6 ? Now to mention a dual-home (Wi-Fi & mobile data)
UA ? Or what if the dCDN is between the UA and the CGN (assuming that the uCDN
or CSP are upstream of the CGN) ?

Also, "If the received signed JWT contains a Client IP claim" uses singular
rather than "one or several"

I also noted that Section 7 (security considerations) puts some restrictions on
the usefulness of cdniip.

I would welcome some applicability statements on the use of cdniip.

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

== COMMENTS ==

-- Section 1.3 --
To be honest, I fail to understand the meaning (hence the value) of figure 3.

== NITS ==

I am afraid that the email address [email-masked] is outdated.

-- Section 1 --
Is CDNI "interconnected CDNs (CDNI)" or "CDN Interconnection (CDNI)" ?

---

From: Phil Sorber <[email-masked]>
Date: Wed, 24 Feb 2021 23:05:49 -0700

Thank you for this thorough review. I have added my responses below.

> https://datatracker.ietf.org/doc/draft-ietf-cdni-uri-signing/

The cdniip claim is considered optional. So it's up to the CSP to determine
if this is needed or not, or if it's even useful. It's something that has
been common in the space and we needed it to maintain feature parity with
existing solutions that we intended to replace. There are definitely
limitations to its use, but it is something we have to include.

> rather than "one or several"

I'm not sure I follow. Can you explain how you would change it?

> I would welcome some applicability statements on the use of cdniip.

It's summarizing whose key of what type to be used in different scenarios,
but I agree it's not very helpful. I'll remove it.

> I am afraid that the email address [email-masked] is outdated.

I'll look into this.

> Is CDNI "interconnected CDNs (CDNI)" or "CDN Interconnection (CDNI)" ?

The latter. I will fix the first one.

>
>
>
> _______________________________________________
> CDNi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cdni
>