Hi Rifaat, Thank you for your review of this draft. Please find below our comments.
Also, please see [1] for the diffs in the updated draft. Thanks, Jasdip & Tom [1] https://author-tools.ietf.org/iddiff?url2=draft-ietf-regext-rdap-geofeed-10 From: Rifaat Shekh-Yusef via Datatracker <nore...@ietf.org> Date: Friday, March 14, 2025 at 10:00 AM To: sec...@ietf.org <sec...@ietf.org> Cc: draft-ietf-regext-rdap-geofeed....@ietf.org <draft-ietf-regext-rdap-geofeed....@ietf.org>, last-c...@ietf.org <last-c...@ietf.org>, regext@ietf.org <regext@ietf.org> Subject: Secdir last call review of draft-ietf-regext-rdap-geofeed-09 Reviewer: Rifaat Shekh-Yusef Review result: Has Issues Section 2.1. “optional Resource Public Key Infrastructure (RPKI, [RFC6480]) signature” Did you mean to refer to RFC6488? [JS] No, RFC 6480 is the introductory RFC for RPKI and this reference helps introduce the “RPKI” term for the first time in the spec. Section 5, Security Considerations “The geofeed file may also contain an RPKI signature.” You might want to add a reference to the RPKI signature spec. [JS] Thanks, added the reference. Also, what is this document’s opinion on this signature? It just states that the file “may contain…” I think it warrants adding a sentence or two to elaborate on this. [JS] In our opinion, since this “may” follows from Section 5 of RFC 9632, the reader should be able to consume related authoritative text from that RFC. “Besides that, this document does not introduce any new security considerations past those already discussed in the RDAP protocol specifications.” You might want to add references to the other specs that cover the security aspects of the RDAP protocol. [JS] Thanks, added the relevant references.
_______________________________________________ regext mailing list -- regext@ietf.org To unsubscribe send an email to regext-le...@ietf.org
