Subject: [Hipsec] I-D Action:draft-ietf-hip-cert-03.txt

From: [email-masked]
Date: Wed, 28 Apr 2010 01:45:01 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Host Identity Protocol Working Group of the IETF.

	Title           : HIP Certificates
	Author(s)       : T. Heer, S. Varjonen
	Filename        : draft-ietf-hip-cert-03.txt
	Pages           : 10
	Date            : 2010-04-28

This document specifies a certificate parameter called CERT for the
Host Identity Protocol (HIP).  The CERT parameter is a container for
X.509.v3 certificates and for Simple Public Key Infrastructure (SPKI)
certificates.  It is used for carrying these certificates in HIP
control packets.  Additionally, this document specifies the
representations of Host Identity Tags in X.509.v3 and in SPKI
certificates.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-hip-cert-03.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: "Mattes, David" <[email-masked]>
Date: Wed, 28 Apr 2010 10:00:53 -0700

Hi Tobias and Samu,

Thank you for this work!

Some comments:
Section 2, last paragraph, 2nd sentence: s/LDAP URL/DN/

Section 3, paragraph 1: I don't agree that HITs need to be enclosed within X.509 certificates.  Many users will not have control over the Certificate Issuing Authorities, or even if they do have that control, will be unable to specify inclusion of the HIT in the certificate.  Furthermore, the issuer may not be involved in HIP communications at all!  I think it is a mistake to require _any_ HIP details to be present in a certificate used for HIP communications, nor do I see why it is necessary.

Section 3, can we add another example that describes a managed PKI environment?  If you agree with my comment about HITs in the certificate, I will write up an example for this case.

Regards,
David Mattes

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Wednesday, April 28, 2010 1:45 AM
To: [email-masked]
Cc: [email-masked]
Subject: [Hipsec] I-D Action:draft-ietf-hip-cert-03.txt

	Title           : HIP Certificates

This document specifies a certificate parameter called CERT for the Host Identity Protocol (HIP).  The CERT parameter is a container for
X.509.v3 certificates and for Simple Public Key Infrastructure (SPKI) certificates.  It is used for carrying these certificates in HIP control packets.  Additionally, this document specifies the representations of Host Identity Tags in X.509.v3 and in SPKI certificates.

Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft.