Subject: [Int-area] Alexey Melnikov's No Objection on draft-ietf-intarea-provisioning-domains-10: (with COMMENT)

From: Alexey Melnikov via Datatracker <[email-masked]>
Date: Fri, 17 Jan 2020 07:40:43 -0800

Alexey Melnikov has entered the following ballot position for
draft-ietf-intarea-provisioning-domains-10: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-intarea-provisioning-domains/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

This is a well written document, but I have a small set of issues I would like
to discuss:

4.4.  Detecting misconfiguration and misuse

   When a host retrieves the PvD Additional Information, it MUST verify
   that the TLS server certificate is valid for the performed request
   (e.g., that the Subject Alternative Name is equal to the PvD ID
   expressed as an FQDN).

The last sentence is not right: you should say “one of Subject Alternative
Names is equal to ... “ because a server certificate can have multiple Subject
Alternative Names.

5.4.  Providing Additional Information to PvD-Aware Hosts

This section is using HTTP/2 syntax for requests and responses, but HTTP 2 RFC
is not listed as a reference.

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 17 Jan 2020 18:58:16 -0800

> https://datatracker.ietf.org/doc/draft-ietf-intarea-provisioning-domains/

Is there a reason to not use the DNS-ID terminology of RFC 6125?

-Ben

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 20 Jan 2020 10:30:52 +0000

Sent from my iPhone

> On 18 Jan 2020, at 02:58, Benjamin Kaduk <[email-masked]> wrote:
> 

Yes, I would prefer that.

Best Regards,
Alexey

---

From: Tommy Pauly <[email-masked]>
Date: Wed, 22 Jan 2020 08:51:27 -0800

Hi Alexey,

Thanks very much for the review! I'm keeping pending changes available here, to be published after the telechat: https://github.com/IPv6-mPvD/mpvd-ietf-drafts/pull/25

I've updated the text to reference a DNS-ID in the cert, and not imply that there is only one such name:

...
(e.g., that a DNS-ID {{?RFC6125}} on the certificate is equal to
the PvD ID expressed as an FQDN)

I've also added a reference to HTTP/2 and mentioned that the example is using the HTTP/2 syntax:

The following example shows a GET request that the host sends, in HTTP/2
syntax {{?RFC7540}}:

Thanks,
Tommy

> On Jan 17, 2020, at 7:40 AM, Alexey Melnikov via Datatracker <[email-masked]> wrote:
> 
> _______________________________________________
> Int-area mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/int-area