Subject: [sipcore] draft-ietf-sipcore-sec-flows-01: binary content issues

From: Brian Hibbard <[email-masked]>
Date: Tue, 24 Nov 2009 15:27:30 -0600

The binary content in the draft has not changed between version -00  
and -01.  There are known deficiencies in the certs and messages in  
the draft.  The draft's content changes drastically when these are  
modified.  Before I generate a version that affects the binary  
content, I want to make sure we have agreement on what the content  
*should* be.

Even though the binary content is not in it's final form, verification  
of the cryptographic content can still proceed.  The cryptographic  
content needs to be verified by someone other than myself before this  
draft can be accepted as RFC (or BCP?).

== In general ==

Certificates need to have a "real" serial number, not 0.

Certificates should have expiration dates far into the future as  
possible if we expect them to be useful.

== Section 4.x ==
We need to generate a new TLS exchange in 4.1 where example.com and  
example.net resolve to different addresses.  This will make the  
example in 4.2 clearer.

== Section 5.x ==
Need more random-looking CSeq values.

Do we need an example where we include a certificate in the message?   
Language in section 6 (paragraph "Observed S/MIME  
interoperability...") suggests we don't.  Do we follow our own  
recommendations, or qualify the recommendation in Section 6?