Cryptographic Message Syntax (CMS) Content Constraints Extension
draft-housley-cms-content-constraints-extn-06

[Ballot comment]
[Updated: Removed original 12.  Two new comments.]

Here are my comments on this draft:

13) In this I-D the reference for ASN.1 in '97, but in PKIX/SMIME New ASN.1 it's '02.

14) Sec 3.1: r/if the certification path is valid for a signed CMS object/if the certification path is valid for a given context.

[Ballot discuss]
[Updated to remove #1, but added a new #2]

2) Can you provide an alternate grouping in section 4 so the things that are done multiple times are set apart from the thing that is done once per CMS path.  I believe this will make things clearer.

[Ballot comment]
[Updated: Removed original 12.  Two new comments.]

Here are my comments on this draft:

13) In this I-D the reference for ASN.1 in '97, but in PKIX/SMIME New ASN.1 it's '02.

14) Sec 3.1: r/if the certification path is valid for a signed CMS object/if the certification path is valid for a given context.

[Ballot discuss]
[Updated]

1) Can you provide an alternate grouping in section 4 so the things that are done multiple times are set apart from the thing that is done once per CMS path.  I believe this will make things clearer.

[Ballot comment]
[Updated: Removed original 12.  Two new comments.]

Here are my comments on this draft:

13) In this I-D the reference for ASN.1 in '97, but in PKIX/SMIME New ASN.1 it's '02.

14) Sec 3.1: r/if the certification path is valid for a signed CMS object/if the certification path is valid for a given context.

[Ballot discuss]
1) Can you provide an alternate grouping in section 4 so the things that are done multiple times are set apart from the thing that is done once per CMS path.  I believe this will make things clearer.

[Ballot comment]
[Updated: Removed original 12.  Two new comments.]

Here are my comments on this draft:

13) In this I-D the reference for ASN.1 in '97, but in PKIX/SMIME New ASN.1 it's '02.

14) Sec 3.1: r/if the certification path is valid for a signed CMS object/if the certification path is valid for a given context.

[Ballot comment]
[Updated: Removed original 12.  One new comment.]

Here are my comments on this draft:

13) In this I-D the reference for ASN.1 in '97, but in PKIX/SMIME New ASN.1 it's '02.

[Ballot comment]
[Updated: Removed original 12.  One new comments]

Here are my comments on this draft:

13) In this I-D the reference for ASN.1 in '97, but in PKIX/SMIME New ASN.1 it's '02.

[Ballot comment]
[Updated: Removed original 11.  Two new comments]

Here are my comments on this draft:

12) Sec 4: r/In such cases, each SignerInfo must be processed as if it were the only SignerInfo, and the CMS content constraints must be met in order for that signature to be considered valid./In such cases, each SignerInfo MUST be processed as if it were the only SignerInfo, and the CMS content constraints MUST be met in order for that signature to be considered valid.

13) In this I-D the reference for ASN.1 in '97, but in PKIX/SMIME New ASN.1 it's '02.

[Ballot comment]
1.  Introduction

  The CMS SignedData [RFC5652] construct is used to sign many things,
  including cryptographic module firmware packages [RFC4108] and
  certificate management messages [RFC5272].  Similarly, the CMS
  AuthenticatedData and CMS AuthEnvelopedData constructs provide
  authentication, which can be affiliated with an originator's static
  public key.  CCC information is conveyed via an extension in a

This is the first use of the CCC acronym, so it should be expanded here
(not not 2 pagraphs below).

  certificate or trust anchor object that contains the originator's or
  signer's public key.



Is the extra complexity of having absenceEqualsUnconstrained worth it?

[Ballot comment]
[Updated: fixed #ing of comments and added a new last comment]

Here are my comments on this draft:

1) Sec 1: r/relying parties MUST ensure/relying parties must ensure

2) Sec 1.2: r/The CMS content constraints mechanism can be used to place limits on the use of the subject public key used key used for .../The CMS content constraints mechanism can be used to place limits on the use of the subject public key used for ...

3) Sec 2 AttrType: r/value must be/value MUST be

4) Sec 3.1: r/If unconstrained, the trust anchor must either include/If unconstrained, the trust anchor MUST either include

5) Sec 3.1: r/trust anchor must have/trust anchor MUST have

6) Sec 3.1: r/processing must still be performed/processing MUST still be performed

7) Sec 3.5: r/then constraints must be checked./then constraints MUST be checked.

8) Sec 4.2: may/MAY X2

9) Sec 4.3: r/checking must be performed/checking MUST be performed

10) A.1 (to make it align with the PKIXASN1 import:

OLD:

FROM CryptographicMessageSyntax-2009

NEW:

FROM -- [SMIMEASN1]
    CryptographicMessageSyntax-2009

11) Add a reference (same kind as PKIX) for SMIMEASN1:

[SMIMEASN1] Hoffman, P. and J. Schaad, "New ASN.1 Modules for SMIME", in progress.

12) Sec 4: r/In such cases, each SignerInfo must be processed as if it were the only SignerInfo, and the CMS content constraints must be met in order for that signature to be considered valid./In such cases, each SignerInfo MUST be processed as if it were the only SignerInfo, and the CMS content constraints MUST be met in order for that signature to be considered valid.

[Ballot discuss]
This is new:

1) References to [PKIXASN1] and [SMIMEASN1] need to normative.  The ASN.1 in these modules is required to implement the module found in Annex A.

[Ballot comment]
Here are my comments on this draft:

1) Sec 1: r/relying parties MUST ensure/relying parties must ensure

1) Sec 1.2: r/The CMS content constraints mechanism can be used to place limits on the use of the subject public key used key used for .../The CMS content constraints mechanism can be used to place limits on the use of the subject public key used for ...

2) Sec 2 AttrType: r/value must be/value MUST be

3) Sec 3.1: r/If unconstrained, the trust anchor must either include/If unconstrained, the trust anchor MUST either include

4) Sec 3.1: r/trust anchor must have/trust anchor MUST have

5) Sec 3.1: r/processing must still be performed/processing MUST still be performed

6) Sec 3.5: r/then constraints must be checked./then constraints MUST be checked.

7) Sec 4.2: may/MAY X2

8) Sec 4.3: r/checking must be performed/checking MUST be performed

9) A.1 (to make it align with the PKIXASN1 import:

OLD:

FROM CryptographicMessageSyntax-2009

NEW:

FROM -- [SMIMEASN1]
    CryptographicMessageSyntax-2009

10) Add a reference (same kind as PKIX) for SMIMEASN1:

[SMIMEASN1] Hoffman, P. and J. Schaad, "New ASN.1 Modules for SMIME", in progress.

State Change Notice email list have been change to housley@vigilsec.com, cwallace@cygnacom.com, srashmo@radium.ncsc.mil, draft-housley-cms-content-constraints-extn@tools.ietf.org, GBeier@cygnacom.com from housley@vigilsec.com, cwallace@cygnacom.com, srashmo@radium.ncsc.mil, draft-housley-cms-content-constraints-extn@tools.ietf.org