Subject: [sidr] I-D Action:draft-ietf-sidr-res-certs-16.txt

From: [email-masked]
Date: Wed, 25 Feb 2009 14:00:01 -0800 (PST)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF.

	Title           : A Profile for X.509 PKIX Resource Certificates
	Author(s)       : G. Huston, et al.
	Filename        : draft-ietf-sidr-res-certs-16.txt
	Pages           : 34
	Date            : 2009-02-25

This document defines a standard profile for X.509 certificates for
the purposes of supporting validation of assertions of "right-of-use"
of an Internet Number Resource (IP Addresses and Autonomous System
Numbers).  This profile is used to convey the issuer's authorization
of the subject to be regarded as the current holder of a "right-of-
use" of the IP addresses and AS numbers that are described in the
issued certificate.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-sidr-res-certs-16.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Terry Manderson <[email-masked]>
Date: Thu, 26 Feb 2009 10:52:36 +1000

I've just finished my read of version 16.

* Section 3.9.5

With the introduction of Extended Key Usage, can I suggest that the  
wording follow that of RFC5280 for consistency in how key purposes are  
constructed?

e.g:
Object identifiers used to identify key purposes MUST be assigned in  
accordance with IANA or ITU-T Recommendation X.660 [X.660].

I also agree that the EKU should be there. It provides a level of  
extensibility.

* Removal of section 6.3

I could not agree more! TA structures are so important in this  
application that they should stand as a topic (*draft*) in their own  
right.

* section 7 Design Notes

firstly " yet still ensure that the structures Subject name changes",  
I think should be
"structure's"

secondly - I had to re-read this paragraph several times to simply  
understand that the advise is to have CAs which use a constant CN per  
entity still change their DN via the serial number at key rollover.  
yeah? Any way this can be revised for us dummies? ;)

* personal nit:

The word uniqueness bugs me ;-) something is either unique or it is  
not. There are no varying degrees of being unique. I'd love to see a  
different word or phrase used - but it isn't a blocker for me.

Cheers
Terry