X.509 Extended Key Usage (EKU) for configuration, updates and safety-communication
draft-ietf-lamps-automation-keyusages-08

[Ballot comment]
Hi Hendrik,

Thank you for addressing my DISCUSS and COMMENT points [1] and also merging the PR. Much appreciated.

I'm still not comfortable including some claims about external organizations/specifications (especially on the safety/security) even if those are in an appendix.

(1) The causality effect is not trivial IMO

  Automation hardware and software products strive to become more safe
  and secure by fulfilling mandatory, generic system requirements
  related to cyber security driven by federal offices

(2) not clear who made the call that "deliverables include due consideration of cyber security..":

The
  deliverables include due consideration of cyber security aspects
  based on the IEC 62443 series of standards, focused on the European
  railway network to which Directive 2016/797 - Interoperability of the
  rail system within the EU [Directive-2016_797] applies.

That's said, I trust the authors and Deb to do the right thing here.

Cheers,
Med

[1] https://mailarchive.ietf.org/arch/msg/spasm/1sC5bIs7r6y2VVask6yu70xPkoE/

[Ballot discuss]
Hi Hendrik/David,

Thank you for the effort put into this profile.

Thanks to Bing Liu for his OPSDIR review. Please consider replying to that review.

## When I first approached the draft, I though the scope is network automation and the like (yes, I'm biased here ;-). I would normally cite this item as a comment, but for this specific document, I think we should be clear about the intended usage (including the title and Section 2).

I suggest we update the title as follows:

OLD:
  X.509 Certificate Extended Key Usage (EKU) for Automation

NEW:
  X.509 Certificate Extended Key Usage (EKU) for Industrial Automation

Idem for the title of Section 3.

## Intended applicability: I’m having troubles to reconcile these two statements:

CURRENT:
  The context in which the KeyPurposeIds defined in this document are
  used is out of scope for this document. 

CURRENT:
  As described in Section 4.2.1.12 of [RFC5280], "[i]f the [extended
  key usage] extension is present, then the certificate MUST only be
  used for one of the purposes indicated" and "[i]f multiple [key]
  purposes are indicated the application need not recognize all
  purposes indicated, as long as the intended purpose is present".

## Mismatch between IANA actions and ASN module:

The id registered in Section 8 does not match id-mod-eu-automation-eku used in the “ASN.1 Module”!

[Ballot discuss]


        This specification focuses on use in industrial automation and rail automation.

I don't find that the "focus" - it is more an example use. I think this sentence should
be removed - also because we don't want people to NOT use these id-kp values if they have
good use for these elsewhere. See also below on "id-mod-automation-eku"


        For example, a technical standard may specify: 'Different keys and
        certificates MUST be used for safety communication and for trust
        anchor updates, and a relying party MUST ignore the KeyPurposeId [...]

        The certificate policy for example may specify: 'The
        id-kp-safetyCommunication KeyPuposeId SHOULD NOT be included [...]

The use of RFC2119 syntax in possible external example literature is confusing.
Can these be turned into lower case words instead?


        The procedures and practices employed by a certification authority MUST ensure

This is a direction to how to use things, which I think should not use RFC2119 language either.


        id-mod-automation-eku

This kinda comes without further explanation. I guess it's a group identifier in a way. But
It seems poorly matched to the values being added. id-kp-safetyCommunication could very well
be used in non-automation ways. What I would like to prevent is that we will get multiple
entries for say id-kp-safetyCommunication within a different group other than id-mod-automation-eku.
For example let's say certificates used for High Level government officials in a Signal Group Chat,
which would clearly not be "automation".

[Ballot comment]
# Orie Steele, ART AD, comments for draft-ietf-lamps-automation-keyusages-06
CC @OR13

* line numbers:
  - https://author-tools.ietf.org/api/idnits?url=https://www.ietf.org/archive/id/draft-ietf-lamps-automation-keyusages-06.txt&submitcheck=True

* comment syntax:
  - https://github.com/mnot/ietf-comments/blob/main/format.md

* "Handling Ballot Positions":
  - https://ietf.org/about/groups/iesg/statements/handling-ballot-positions/

## Comments

### SHOULD require that corresponding KeyPurposeIds

```
226   Systems or applications that verify the signature of a general-
227   purpose configuration file or trust anchor configuration file, the
228   signature of a software or firmware update package, or the
229   authentication of a communication peer for safety-critical
230   communication SHOULD require that corresponding KeyPurposeIds be
231   specified by the EKU extension.  If the certificate requester knows
```

I take it this is not a MUST for backward compatibility reasons.
Are there any cases where this is a MUST or where it is a MUST NOT?

## Nits

### clinetAuth -> clientAuth
```
330   anyExtendedKeyUsage KeyPurposeId.  Examples of allowed KeyPurposeIds
331   combinations can be the presence of id-kp-safetyCommunication
332   together with id-kp-clinetAuth or id-kp-serverAuth.
```

[Ballot comment]
Thank you to Stewart Bryant for the GENART review.

Comment for the WG and responsible AD: Please consider if the LAMPS WG charter needs to be clarified.  It currently contains this language "In addition, the LAMPS WG may investigate other updates to documents produced by the PKIX and S/MIME WG. The LAMPS WG may produce clarifications where needed, but the LAMPS WG shall not adopt anything beyond clarifications without rechartering."  Are these EKUs considered a clarifying update to a PKIX document?

[Ballot comment]
Section 1 makes several strong claims about things that don't have to do with the technical properties of our protocols. Fine to reference the regulations and describe their goals, but it doesn't seem appropriate to make definitive statements about the outcomes those regulations will achieve/deliver. We simply can't know that, and making those assertions isn't the IETF's role. Related, the first half of this section reads as if this document were a product of the ERJU System Pillar rather than an IETF specification. I encourage reworking the tone here.

Section 3's example specification language seem quite specific. Are these quotes from somewhere that should be referenced?

I'm unclear what makes "safety-critical communication" a key usage and what separates it from client/server authentication more broadly. I would have thought that "safety-critical" is a property of the message, with rules around which authenticated clients/servers are trusted when they assert that their messages are safety-critical. Is this effectively just moving that rule set into the CA? (It's fine to just educate me on this question, but it might be worth including the answer in the document as well.)

Minor nit:
- In Section 1, s/internet/Internet/

[Ballot comment]
# Andy Newton, ART AD, comments for draft-ietf-lamps-automation-keyusages-05
CC @anewton1998

* line numbers:
  - https://author-tools.ietf.org/api/idnits?url=https://www.ietf.org/archive/id/draft-ietf-lamps-automation-keyusages-05.txt&submitcheck=True

* comment syntax:
  - https://github.com/mnot/ietf-comments/blob/main/format.md

* "Handling Ballot Positions":
  - https://ietf.org/about/groups/iesg/statements/handling-ballot-positions/

## Comments

Thank you for the work on this document.

I have the following comments.

### General Applicability

11      Abstract

13        RFC 5280 defines the ExtendedKeyUsage extension and several extended
14        key purpose identifiers (KeyPurposeIds) for use with that extension
15        in X.509 certificates.  This document defines KeyPurposeIds for
16        general-purpose and trust anchor configuration files, for software
17        and firmware update packages, and for safety-critical communication
18        to be included in the Extended Key Usage (EKU) extension of X.509 v3
19        public key certificates used by industrial automation and the
20        Europe's Rail Joint Undertaking (ERJU) System Pillar.

Is this a generally usable specification or intended mostly for the ERJU?
My impression is that this document has a broader use than just the ERJU,
and if so perhaps that langauge of the last sentence could be adjusted so it
is not suggestive of the narrower application.

My suggestion:

"... to be included in the Extended Key Usage (EKU) extension of X.509 v3
public key certificates, such as those used by industrial automation and the
Europe's Rail Joint Undertaking (ERJU) System Pillar.""

### A Long Intro

72      1.  Introduction

74        Automation hardware and software products will strategically be more
75        safe and secure by fulfilling mandatory, generic system requirements
76        related to cyber security driven by federal offices like the European
77        Union Cyber Resilience Act [EU-CRA] governed by the European
78        Commission and the High Representative of the Union for Foreign
79        Affairs and Security Policy.  Automation products connected to the
80        internet would bear the so called CE marking [CE-marking] to indicate
81        they comply.  Such regulation was announced in the 2020 EU
82        Cybersecurity Strategy [EU-STRATEGY], and complements other
83        legislation in this area, specifically the NIS2 Framework, Directive
84        on measures for a high common level of cybersecurity across the Union
85        [NIS2]. 2020 EU Cybersecurity Strategy suggests to implement and
86        extend international standards such as the Security for industrial
87        automation and control systems - Part 4-2: Technical security
88        requirements for IACS components [IEC.62443-4-2] (IACS refers to
89        industrial automation and control system) and the Industrial
90        communication networks - Network and system security - Part 3-3:
91        System security requirements and security levels [IEC.62443-3-3].
92        Automation hardware and software products of diverse vendors that are
93        connected on automation networks and the internet build common
94        automation solutions.  Harmonized attributes would allow transparency
95        of security properties and interoperability for vendors in context of
96        secure software and firmware updates, general-purpose configuration,
97        trust anchor configuration, and secure safety communication.

...

I agree with the other reviewers with regard to this being a long introduction.
IMHO, this would be more readable if the introduction summarized the technical
aspects of the specification and referenced the applicability in an appendix.

### TLS WWW Client and Server

149        The KeyPurposeId id-kp-serverAuth (Section 4.2.1.12 of [RFC5280]) can
150        be used to identify that the certificate is for a TLS WWW server, and
151        the KeyPurposeId id-kp-clientAuth (Section 4.2.1.12 of [RFC5280]) can
152        be used to identify that the certificate is for a TLS WWW client.
153        However, there are currently no KeyPurposeIds for usage with X.509
154        certificates for safety-critical communication.

Can the terms TLS WWW server and TLS WWW client be changed to HTTPS server
and HTTPS client? Or is there something specific to these clients being
based on web browsers?

### Relying Party or Relying Party Software

317        To reduce the risk of specific cross-protocol attacks, the relying
318        party or the relying party software may additionally prohibit use of

Does the software need to be explicitly mentioned? Can this just say "relying party"?

### Concrete Requirements

322        party, is defined in Section 4 of [RFC9336].  The technical standards
323        and certificate policies of the application should specify concrete
324        requirements for excluded or permitted KeyPurposeIds or their
325        combinations.  An example of excluded KeyPurposeIds can be the

In my opinion, "concrete requirements" is not concrete enough. :)
Would the following wording be helpful?

"... the application should explicitly enumerate requirements..."

[Ballot comment]
## General note 1: I understand that the profile grabbed some text from other similar specs. However, I have some concerns about some constructs such as

CURRENT:
  The procedures and practices employed by a certification authority
  MUST ensure that the correct values for the EKU extension as well as
  the KU extension are inserted in each certificate that is issued.

Saying that entity A MUST ensure the correct values are used is "obvious".

BTW, s/certification authority/CA

## General note 2: Please use terminology that is consistent with RFC 5280. For example, there is not “key purpose identifiers” in 5280, but “key purposes”.

## Abstract: use terms as defined in 5280 + expand in first use

OLD:
  RFC 5280 defines the ExtendedKeyUsage extension and several extended
  key purpose identifiers (KeyPurposeIds) for use with that extension
  in X.509 certificates.  This document defines KeyPurposeIds for
  general-purpose and trust anchor configuration files, for software
  and firmware update packages, and for safety-critical communication
  to be included in the Extended Key Usage (EKU) extension of X.509 v3
  public key certificates used by industrial automation and the
  Europe's Rail Joint Undertaking (ERJU) System Pillar.

NEW:
  RFC 5280 defines the Extended Key Usage (EKU) extension and several extended
  key purposes (KeyPurposeIds) for use with that extension
  in X.509 certificates.  This document defines KeyPurposeIds for
  general-purpose and trust anchor configuration files, for software
  and firmware update packages, and for safety-critical communication
  to be included in the EKU extension of X.509 v3
  public key certificates used by industrial automation and the
  Europe's Rail Joint Undertaking (ERJU) System Pillar.

## Introduction:

(1) Many statements in the introduction are not adequate for an IETF document. For example, consider the first sentence, and putting aside that I don’t parse it well, I don’t think we need to make such claims in an RFC.

(2) There are also several terms that are not well defined (e.g., Harmonized attributes)

(3) There are statements that would not age well (e.g., will deliver)

(4) There is several material in the introduction that is good for initial draft versions, but I don’t think this fits in an RFC

## Section 2:

(1) I suggest to add this NEW:

  This document uses terms defined in [RFC5280].

  X.509 certificate X.509 extensions are defined using ASN.1
  [X.680] and [X.690].

(2) Define what is meant by “safety-critical communication” as this is key to identify the applicability scope of this spec.

## Section 4

(1) consider changing the various occurrences of “may be” to “is”

(2) “secure  software or firmware update packages”: this seems to restrict the scope to “secure” update (whatsoever that means), while Section 3 uses “signature of a software or firmware update package”. I think that we can remove “secure”. Please double check the various uses in the spec.

[Ballot comment]
Thank you for preparing this document, I have the following comments:

1. The introduction includes:  “will strategically be more safe and secure”. I think that an RFC cannot make such a claim, please consider an alternate phrase, perhaps using “are designed to make”.

2. The first para of the introduction is long. please divide this into paragraphs (or preferably a set of subsections)
.
3. The sentence below (and following) seems like it belongs in a different paragraph:
“Automation hardware and software products of diverse vendors that are connected on automation networks and the internet build common automation solutions.” Here, I think the word “build” here is problematic and I suggest this could be “can be used to build” is much easier to read.

4. I found the last paragraph of the introduction a little hard to parse and understand, but I suspect this may be important. Is something like this a possible clearer statement?

  This specification focuses on use in industrial automation.
  The definitions are intentionally broad to also allow use of the
  KeyPurposeIds in other deployments. The details for
  each implementation needs to be described in technical standards and certificate policies.

5. Several words are used to describe similar things, and it was not clear what the difference was between “applications” “deployments” and “implementations”. Please see if fewer terms could be used to simplify reading, and makes sure it clearly sets out the various uses.

6. I expect the following sentence is about the privacy considerations: “The inclusion of the EKU extension can help an observer determine the purpose of the certificate.” - But I don’t exactly see what this implies, please explain, possibly adding “which may reveal private information”?

[Ballot discuss]
Hi Hendrik/David,

Thank you for the effort put into this profile.

## When I first approached the draft, I though the scope is network automation and the like (yes, I'm biased here ;-). I would normally cite this item as a comment, but for this specific document, I think we should be clear about the intended usage (including the title and Section 2).

I suggest we update the title as follows:

OLD:
  X.509 Certificate Extended Key Usage (EKU) for Automation

NEW:
  X.509 Certificate Extended Key Usage (EKU) for Industrial Automation

Idem for the title of Section 3.

## Intended applicability: I’m having troubles to reconcile these two statements:

CURRENT:
  The context in which the KeyPurposeIds defined in this document are
  used is out of scope for this document. 

CURRENT:
  As described in Section 4.2.1.12 of [RFC5280], "[i]f the [extended
  key usage] extension is present, then the certificate MUST only be
  used for one of the purposes indicated" and "[i]f multiple [key]
  purposes are indicated the application need not recognize all
  purposes indicated, as long as the intended purpose is present".

## Mismatch between IANA actions and ASN module:

The id registered in Section 8 does not match id-mod-eu-automation-eku used in the “ASN.1 Module”!

[Ballot comment]
FWIW, my full review can be found at:

* pdf: https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/2025/draft-ietf-lamps-automation-keyusages-05-rev%20Med.pdf
* doc: https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/2025/draft-ietf-lamps-automation-keyusages-05-rev%20Med.doc

Only a subset of items are echoed here. The author can refer to the full review
for nits/edits/etc.

## General note 1: I understand that the profile grabbed some text from other similar specs. However, I have some concerns about some constructs such as

CURRENT:
  The procedures and practices employed by a certification authority
  MUST ensure that the correct values for the EKU extension as well as
  the KU extension are inserted in each certificate that is issued.

Saying that entity A MUST ensure the correct values are used is "obvious".

BTW, s/certification authority/CA

## General note 2: Please use terminology that is consistent with RFC 5280. For example, there is not “key purpose identifiers” in 5280, but “key purposes”.

## Introduction:

(1) Many statements in the introduction are not adequate for an IETF document. For example, consider the first sentence, and putting aside that I don’t parse it well, I don’t think we need to make such claims in an RFC.

(2) There are also several terms that are not well defined (e.g., Harmonized attributes)

(3) There are statements that would not age well (e.g., will deliver)

(4) There is several material in the introduction that is good for initial draft versions, but I don’t think this fits in an RFC

## Section 2:

(1) I suggest to add this NEW:

  This document uses terms defined in [RFC5280].

  X.509 certificate X.509 extensions are defined using ASN.1
  [X.680] and [X.690].

(2) Define what is meant by “safety-critical communication” as this is key to identify the applicability scope of this spec.

## Section 4

(1) consider changing the various occurrences of “may be” to “is”

(2) “secure  software or firmware update packages”: this seems to restrict the scope to “secure” update (whatsoever that means), while Section 3 uses “signature of a software or firmware update package”. I think that we can remove “secure”. Please double check the various uses in the spec.

[Ballot comment]
Just two minor non-blocking comments:

1) the mention of the railway use case in the abstract is distracting, suggest removing it

2) the 1st paragraph is section 1 is also distracting and useless. In the same vein, have a subsection about "use case" where the railway use case can then fit nicer without disturbing the natural flow

Note: based on authors/contributors' affiliations, I appreciate that this document comes from the railway use case.

[Ballot comment]
# Internet AD comments for draft-ietf-lamps-automation-keyusages-05
CC @ekline

* comment syntax:
  - https://github.com/mnot/ietf-comments/blob/main/format.md

* "Handling Ballot Positions":
  - https://ietf.org/about/groups/iesg/statements/handling-ballot-positions/

## Comments

### S1

* "will strategically be more safe and secure by fulfilling mandatory,
  generic system requirements related to cyber security driven by federal"

  I don't think this is really a defensible statement.  They certainly
  "aim to be more safe ...", but whether they are or not is a function of
  a great many factors, including the quality and "up-to-date-ness" of
  various federal regulations.

IESG/Authors/WG Chairs:

IANA has completed its review of draft-ietf-lamps-automation-keyusages-04. If any part of this review is inaccurate, please let us know.

IANA understands that, upon approval of this document, there are two actions which we must complete.

First, in the SMI Security for PKIX Module Identifier registry in the Structure of Management Information (SMI) Numbers (MIB Module Registrations) registry group located at:

https://www.iana.org/assignments/smi-numbers/

a single new registration will be made as follows:

Decimal: [ TBD-at-Registration ]
Description: id-mod-automation-eku
Reference: [ RFC-to-be ]

As this document requests a registration in an Expert Review or Specification Required (see RFC 8126) registry, we have completed the required Expert Review via a separate request.

Second, in the SMI Security for PKIX Extended Key Purpose registry also in the Structure of Management Information (SMI) Numbers (MIB Module Registrations) registry group located at:

https://www.iana.org/assignments/smi-numbers/

four existing Temporary registrations will be made permanent and their references changed to [ RFC-to-be ] as follows:

Decimal: 41
Description: id-kp-configSigning
Reference: [ RFC-to-be ]

Decimal: 42
Description: id-kp-trustAnchorConfigSigning
Reference: [ RFC-to-be ]

Decimal: 43
Description: id-kp-updatePackageSigning
Reference: [ RFC-to-be ]

Decimal: 44
Description: id-kp-safetyCommunication
Reference: [ RFC-to-be ]

We understand that these are the only actions required to be completed upon approval of this document.

NOTE: The actions requested in this document will not be completed until the document has been approved for publication as an RFC. This message is meant only to confirm the list of actions that will be performed.

For definitions of IANA review states, please see:

https://datatracker.ietf.org/help/state/draft/iana-review

Thank you,

David Dong
IANA Services Sr. Specialist

The following Last Call announcement was sent out (ends 2025-02-07):

From: The IESG
To: IETF-Announce
CC: debcooley1@gmail.com, draft-ietf-lamps-automation-keyusages@ietf.org, housley@vigilsec.com, lamps-chairs@ietf.org, spasm@ietf.org
Reply-To: last-call@ietf.org
Sender:
Subject: Last Call:  (X.509 Certificate Extended Key Usage (EKU) for Automation) to Proposed Standard


The IESG has received a request from the Limited Additional Mechanisms for
PKIX and SMIME WG (lamps) to consider the following document: - 'X.509
Certificate Extended Key Usage (EKU) for Automation'
  as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
last-call@ietf.org mailing lists by 2025-02-07. Exceptionally, comments may
be sent to iesg@ietf.org instead. In either case, please retain the beginning
of the Subject line to allow automated sorting.

Abstract


  RFC 5280 specifies several extended key purpose identifiers
  (KeyPurposeIds) for X.509 certificates.  This document defines
  KeyPurposeIds for general-purpose and trust anchor configuration
  files, for software and firmware update packages, and for safety-
  critical communication to be included in the Extended Key Usage (EKU)
  extension of X.509 v3 public key certificates used by industrial
  automation and the ERJU System Pillar.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-lamps-automation-keyusages/



No IPR declarations have been submitted directly on this I-D.

Shepherd Write-up for draft-ietf-lamps-automation-keyusages-02


(1) Does the working group (WG) consensus represent the strong
concurrence of a few individuals, with others being silent, or did it
reach broad agreement?

  There is support for this document in the LAMPS WG.  Some people
  originally thought that this document was needed by too few
  implementers to become and RFC, but after a fair amount of
  discussion, there was consensus to go forward when it became
  clear that more than one vender would likely need these key usage
  values.

(2) Was there controversy about particular points, or were there
decisions where the consensus was particularly rough?

  During the WG Last Call no one spoke against the document, and
  there expression of support.
 
(3) Has anyone threatened an appeal or otherwise indicated extreme
discontent?  If so, please summarize the areas of conflict in separate
email messages to the responsible Area Director.  (It should be in a
separate email because this questionnaire is publicly available.)

  No one has threatened an appeal or indicated any discontent.

(4) For protocol documents, are there existing implementations of the
contents of the document?  Have a significant number of potential
implementers indicated plans to implement?  Are any existing
implementations reported somewhere, either in the document itself (as
RFC 7942 recommends) or elsewhere (where)?

  It is clear that some people plan to implement.

(5) Does this document need review from other IETF working groups or
external organizations?  Have those reviews occurred?

  None needed.

(6) Describe how the document meets any required formal expert review
criteria, such as the MIB Doctor, YANG Doctor, media type, and URI type
reviews.

  ASN.1 is used.  The document shepherd compiled the ASN.1 module
  after inserting placeholder values for the ones that need to be
  assigned by IANA.  It compiles without errors.

(7) If the document contains a YANG module, has the final version of the
module been checked with any of the recommended validation tools for
syntax and formatting validation?  If there are any resulting errors or
warnings, what is the justification for not fixing them at this time?
Does the YANG module comply with the Network Management Datastore
Architecture (NMDA) as specified in RFC 8342?

  YANG is not used in the document.

(8) Describe reviews and automated checks performed to validate sections
of the final version of the document written in a formal language, such
as XML code, BNF rules, MIB definitions, CBOR's CDDL, etc.

  ASN.1 is used.  The document shepherd compiled the ASN.1 module
  after inserting placeholder values for the ones that need to be
  assigned by IANA.  It compiles without errors.

(9) Based on the shepherd's review of the document, is it their opinion
that this document is needed, clearly written, complete, correctly
designed, and ready to be handed off to the responsible Area Director?

  The document shepherd finds the document clear and complete.

(10) Several IETF Areas have assembled lists of common issues that their
reviewers encounter.  Do any such issues remain that would merit specific
attention from subsequent reviews?

  The document shepherd finds no concerns.

(11) What type of RFC publication is being requested on the IETF stream
(Best Current Practice, Proposed Standard, Internet Standard,
Informational, Experimental, or Historic)?  Why is this the proper type
of RFC?  Do all Datatracker state attributes correctly reflect this
intent?

  Proposed Standard.  The datatracker indicates this intent.

(12) Has the interested community confirmed that any and all appropriate
IPR disclosures required by BCP 78 and BCP 79 have been filed?  If not,
explain why.  If yes, summarize any discussion and conclusion regarding
the intellectual property rights (IPR) disclosures, including links to
relevant emails.

  Each author has explicitly confirmed that all IPR disclosures that
  are required for full conformance with the provisions of BCP 78
  and BCP 79 have already been filed.  There are none.

(13) Has each Author or Contributor confirmed their willingness to be
listed as such?  If the number of Authors/Editors on the front page is
greater than 5, please provide a justification.

  Each author has explicitly confirmed their willingness to be listed
  as an author.  All contributors are listed as authors.

(14) Identify any remaining I-D nits in this document.  (See the idnits
tool and the checkbox items found in Guidelines to Authors of
Internet-Drafts).  Simply running the idnits tool is not enough; please
review the entire guidelines document.

  IDnits raises one issue: Found 'SHOULD not' in the text.
  This can be resolved with other IETF Last Call comments.

(15) Should any informative references be normative or vice-versa?

  All references are in the proper category.

(16) List any normative references that are not freely available to
anyone.  Did the community have sufficient access to review any such
normative references?

  All normative references are RFCs or ITU-T recommendations.  All
  of these are freely available for download.

(17) Are there any normative downward references (see RFC 3967, BCP 97)?
If so, list them.

  There are no downrefs.

(18) Are there normative references to documents that are not ready for
advancement or are otherwise in an unclear state?  If they exist, what is
the plan for their completion?

  All of the normative references have already been published.

(19) Will publication of this document change the status of any existing
RFCs?  If so, does the Datatracker metadata correctly reflect this and
are those RFCs listed on the title page, in the abstract, and discussed
in the introduction?  If not, explain why and point to the part of the
document where the relationship of this document to these other RFCs is
discussed.

  Publication of this document will not effect the status of any
  other documents.

(20) Describe the document shepherd's review of the IANA considerations
section, especially with regard to its consistency with the body of the
document.  Confirm that all aspects of the document requiring IANA
assignments are associated with the appropriate reservations in IANA
registries.  Confirm that any referenced IANA registries have been
clearly identified.  Confirm that each newly created IANA registry
specifies its initial contents, allocations procedures, and a reasonable
name (see RFC 8126).

  No concerns were found.  The IANA Considerations ask IANA to assign
  some object identifiers from existing registries, and the document
  shepherd is the IANA Designated Expert for the registries where these
  will be assigned.

(21) List any new IANA registries that require Designated Expert Review
for future allocations.  Are the instructions to the Designated Expert
clear?  Please include suggestions of designated experts, if appropriate.

  No new IANA registries are needed.

Shepherd Write-up for draft-ietf-lamps-automation-keyusages-02


(1) Does the working group (WG) consensus represent the strong
concurrence of a few individuals, with others being silent, or did it
reach broad agreement?

  There is support for this document in the LAMPS WG.  Some people
  originally thought that this document was needed by too few
  implementers to become and RFC, but after a fair amount of
  discussion, there was consensus to go forward when it became
  clear that more than one vender would likely need these key usage
  values.

(2) Was there controversy about particular points, or were there
decisions where the consensus was particularly rough?

  During the WG Last Call no one spoke against the document, and
  there expression of support.
 
(3) Has anyone threatened an appeal or otherwise indicated extreme
discontent?  If so, please summarize the areas of conflict in separate
email messages to the responsible Area Director.  (It should be in a
separate email because this questionnaire is publicly available.)

  No one has threatened an appeal or indicated any discontent.

(4) For protocol documents, are there existing implementations of the
contents of the document?  Have a significant number of potential
implementers indicated plans to implement?  Are any existing
implementations reported somewhere, either in the document itself (as
RFC 7942 recommends) or elsewhere (where)?

  It is clear that some people plan to implement.

(5) Does this document need review from other IETF working groups or
external organizations?  Have those reviews occurred?

  None needed.

(6) Describe how the document meets any required formal expert review
criteria, such as the MIB Doctor, YANG Doctor, media type, and URI type
reviews.

  ASN.1 is used.  The document shepherd compiled the ASN.1 module
  after inserting placeholder values for the ones that need to be
  assigned by IANA.  It compiles without errors.

(7) If the document contains a YANG module, has the final version of the
module been checked with any of the recommended validation tools for
syntax and formatting validation?  If there are any resulting errors or
warnings, what is the justification for not fixing them at this time?
Does the YANG module comply with the Network Management Datastore
Architecture (NMDA) as specified in RFC 8342?

  YANG is not used in the document.

(8) Describe reviews and automated checks performed to validate sections
of the final version of the document written in a formal language, such
as XML code, BNF rules, MIB definitions, CBOR's CDDL, etc.

  ASN.1 is used.  The document shepherd compiled the ASN.1 module
  after inserting placeholder values for the ones that need to be
  assigned by IANA.  It compiles without errors.

(9) Based on the shepherd's review of the document, is it their opinion
that this document is needed, clearly written, complete, correctly
designed, and ready to be handed off to the responsible Area Director?

  The document shepherd finds the document clear and complete.

(10) Several IETF Areas have assembled lists of common issues that their
reviewers encounter.  Do any such issues remain that would merit specific
attention from subsequent reviews?

  The document shepherd finds no concerns.

(11) What type of RFC publication is being requested on the IETF stream
(Best Current Practice, Proposed Standard, Internet Standard,
Informational, Experimental, or Historic)?  Why is this the proper type
of RFC?  Do all Datatracker state attributes correctly reflect this
intent?

  Proposed Standard.  The datatracker indicates this intent.

(12) Has the interested community confirmed that any and all appropriate
IPR disclosures required by BCP 78 and BCP 79 have been filed?  If not,
explain why.  If yes, summarize any discussion and conclusion regarding
the intellectual property rights (IPR) disclosures, including links to
relevant emails.

  Each author has explicitly confirmed that all IPR disclosures that
  are required for full conformance with the provisions of BCP 78
  and BCP 79 have already been filed.  There are none.

(13) Has each Author or Contributor confirmed their willingness to be
listed as such?  If the number of Authors/Editors on the front page is
greater than 5, please provide a justification.

  Each author has explicitly confirmed their willingness to be listed
  as an author.  All contributors are listed as authors.

(14) Identify any remaining I-D nits in this document.  (See the idnits
tool and the checkbox items found in Guidelines to Authors of
Internet-Drafts).  Simply running the idnits tool is not enough; please
review the entire guidelines document.

  IDnits raises one issue: Found 'SHOULD not' in the text.
  This can be resolved with other IETF Last Call comments.

(15) Should any informative references be normative or vice-versa?

  All references are in the proper category.

(16) List any normative references that are not freely available to
anyone.  Did the community have sufficient access to review any such
normative references?

  All normative references are RFCs or ITU-T recommendations.  All
  of these are freely available for download.

(17) Are there any normative downward references (see RFC 3967, BCP 97)?
If so, list them.

  There are no downrefs.

(18) Are there normative references to documents that are not ready for
advancement or are otherwise in an unclear state?  If they exist, what is
the plan for their completion?

  All of the normative references have already been published.

(19) Will publication of this document change the status of any existing
RFCs?  If so, does the Datatracker metadata correctly reflect this and
are those RFCs listed on the title page, in the abstract, and discussed
in the introduction?  If not, explain why and point to the part of the
document where the relationship of this document to these other RFCs is
discussed.

  Publication of this document will not effect the status of any
  other documents.

(20) Describe the document shepherd's review of the IANA considerations
section, especially with regard to its consistency with the body of the
document.  Confirm that all aspects of the document requiring IANA
assignments are associated with the appropriate reservations in IANA
registries.  Confirm that any referenced IANA registries have been
clearly identified.  Confirm that each newly created IANA registry
specifies its initial contents, allocations procedures, and a reasonable
name (see RFC 8126).

  No concerns were found.  The IANA Considerations ask IANA to assign
  some object identifiers from existing registries, and the document
  shepherd is the IANA Designated Expert for the registries where these
  will be assigned.

(21) List any new IANA registries that require Designated Expert Review
for future allocations.  Are the instructions to the Designated Expert
clear?  Please include suggestions of designated experts, if appropriate.

  No new IANA registries are needed.