Subject: [stir] I-D Action: draft-ietf-stir-certificates-12.txt

From: [email-masked]
Date: Mon, 13 Mar 2017 15:45:43 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Secure Telephone Identity Revisited of the IETF.

        Title           : Secure Telephone Identity Credentials: Certificates
        Authors         : Jon Peterson
                          Sean Turner
	Filename        : draft-ietf-stir-certificates-12.txt
	Pages           : 20
	Date            : 2017-03-13

Abstract:
   In order to prevent the impersonation of telephone numbers on the
   Internet, some kind of credential system needs to exist that
   cryptographically asserts authority over telephone numbers.  This
   document describes the use of certificates in establishing authority
   over telephone numbers, as a component of a broader architecture for
   managing telephone numbers as identities in protocols like SIP.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-stir-certificates/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-stir-certificates-12

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-certificates-12

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Russ Housley <[email-masked]>
Date: Tue, 14 Mar 2017 15:58:15 -0400

>   managing telephone numbers as identities in protocols like SIP.

Section 8 was essentially rewritten to address the DISCUSS ballot position raised by Alexey, which said:

   Discuss (2016-11-01 for -11)

   I have one small issue that I would like to discuss before recommending approval of this document:

   Reading Section 8 I was unable to figure out what are "claim", "permitted" and "excluded" and what exact syntaxes they use. I think this is underspecified.
   You are probably missing some references, examples or both.

Part of the resolution was to simplify the constraint syntax by removing the excluded claim values.  This changes the limits that a certificate issuer might want to impose on a subordinate.

Also, Section 9 includes a small but significant change.  The SPID value in TNEntry was changed allow any service provider code, including OCNs and SPIDs.

Please review the new text in Section 8 and the change in Section 9.  Please make loud noises now if either of them causes any concern.

Russ