Skip to main content

Last Call Review of draft-ietf-tls-subcerts-12
review-ietf-tls-subcerts-12-artart-lc-amsuess-2022-04-05-00

Request Review of draft-ietf-tls-subcerts
Requested revision No specific revision (document currently at 15)
Type Last Call Review
Team ART Area Review Team (artart)
Deadline 2022-04-08
Requested 2022-03-19
Authors Richard Barnes , Subodh Iyengar , Nick Sullivan , Eric Rescorla
I-D last updated 2022-04-05
Completed reviews Artart Last Call review of -12 by Christian Amsüss (diff)
Genart Last Call review of -12 by Elwyn B. Davies (diff)
Assignment Reviewer Christian Amsüss
State Completed
Request Last Call review on draft-ietf-tls-subcerts by ART Area Review Team Assigned
Posted at https://mailarchive.ietf.org/arch/msg/art/7lzdOaiccRnXFtSuX3aUyh9ffV8
Reviewed revision 12 (document currently at 15)
Result Ready w/nits
Completed 2022-04-05
review-ietf-tls-subcerts-12-artart-lc-amsuess-2022-04-05-00
Thanks for this well-written document

ART topics:

The document does not touch on any of the typical ART review issues; times are
relative in well understood units, and versioning, formal language (ASN.1,
which is outside of my experience to check) and encoding infrastructure
(struct) follows TLS practices.

General comments:

* The introduction of this mechanism gives the impression of a band-aid applied
to a PKI ecosystem that has accumulated many limitations as outlined in section
3.1. The present solution appears good, but if there is ongoing work on the
underlying issues (even experimentally), I'd appreciate a careful reference to
it.

* Section 7.6 hints at the front end querying the back-end for creation of new
DCs -- other than that, DC distribution (neither push- nor pull-based) is
discussed. If there are any mechanisms brewing, I'd appreciate a reference as
well.

Please check:

* The IANA considerations list "delegated_credential" for CH, CR and CT
messages. I did not find a reference in the text for Ct, only for CH and CR.

Editorial comments:

* (p5) "result for the peer.." -- extraneous period.
* (p9, p15, p16) The "7 days" are introduced as the default for a profilable
prarameter, but later used without further comment.