On 24/02/11 13:11, Samu Varjonen wrote:
On 16/02/11 17:16, Vijay K. Gurbani wrote:
I am the assigned Gen-ART reviewer for this draft. For background on
Gen-ART, please see the FAQ at
<http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>.
Please resolve these comments along with any other Last Call comments
you may receive.
Document: draft-ietf-hip-cert-09
Reviewer: Vijay K. Gurbani
Review Date: Feb-16-2011
IETF LC End Date: Mar-01-2011
IESG Telechat date: Mar-03-2011
Summary: 1 major issue. Besides that, the draft is ready as an
Experimental.
Major issues: 1
Minor issues: 0
Nits: 1
Major issue:
- Has this draft been vetted through pkix? I am curious: what
happens if both the CN and SAN are present? Which one takes
precedence? In your Appendix B, you show the CN and SAN as both
being the same, but what happens if they are different? You may
want to check with the pkix WG folks to make sure that the your
use of identities in CN and SAN are okay.
CN and SAN should not be different. The SAN is the primary way of incorporating
the HITs into the certificates. The CN part is a reminder for the developer that
the DN cannot be empty and as a last resort you can put the HIT into the CN. IMO
it should be clearly written into the document that when CN is used it must be
the same HIT as the SAN.
Nits:
- S3:
s/or the subject the respective HIT/or the subject, the respective HIT/
OK
Thanks for the comments. I will look into these as soon as possible and will
give an answer to them on this chain.
Sorry, for the delay.
BR,
Samu Varjonen
BR,
Samu Varjonen
Thanks,
- vijay
_______________________________________________
Gen-art mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/gen-art
