Subject: [secdir] Secdir last call review of draft-ietf-lamps-rfc6844bis-06

From: Stefan Santesson via Datatracker <[email-masked]>
Date: Wed, 29 May 2019 17:37:46 -0700

Reviewer: Stefan Santesson
Review result: Ready

This document is well written and in general I do not have any comment on the
content beyond the previous reviews.

One thing do come to my mind though.
A common aspect of standards documents is that they only are relevant to those
who declare compliance to the standard. This document is different as it relies
on that all parties (CA:s) are aware of this standard and performs the
stipulated checks.

In the end I assume that this may affect relying parties and how they determine
wether a particular certificate is valid, even if that is not the intention of
this standard. I sort of miss a discussion on this in the security
considerations section.

But that is nothing that should prevent this document from being accepted.

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Thu, 30 May 2019 11:30:10 -0700

> on that all parties (CA:s) are aware of this standard and performs the

In practice this has been stipulated for public CAs by the CA/Browser 
Forum Baseline Requirements since September 2017: 
https://cabforum.org/2017/03/08/ballot-187-make-caa-checking-mandatory/.

In other words, the CP for this particular community of trust 
incorporates RFC 6844, making it mandatory. The intent is that once 
RFC6844bis is standardized, CA/Browser Forum will have a followup ballot 
incorporating it.

---

From: Tim Hollebeek <[email-masked]>
Date: Thu, 30 May 2019 18:40:30 +0000

Just to make it official, I'm the chair of the Validation Subcommittee of the 
Server Certificate Working Group of the CA/Browser Forum, and I intend to 
submit a ballot to make RFC 6844bis mandatory in the event it is published as 
an IETF RFC.

-Tim

> -----Original Message-----
> From: Jacob Hoffman-Andrews <[email-masked]>
> Sent: Thursday, May 30, 2019 2:30 PM
> To: Stefan Santesson <[email-masked]>; [email-masked]
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: Re: Secdir last call review of draft-ietf-lamps-rfc6844bis-06
>
> > A common aspect of standards documents is that they only are relevant
> > to those who declare compliance to the standard. This document is
> > different as it relies on that all parties (CA:s) are aware of this
> > standard and performs the stipulated checks.
>
> In practice this has been stipulated for public CAs by the CA/Browser Forum
> Baseline Requirements since September 2017:
> In other words, the CP for this particular community of trust incorporates 
> RFC
> 6844, making it mandatory. The intent is that once RFC6844bis is 
> standardized,
> CA/Browser Forum will have a followup ballot incorporating it.