Reviewer: Suhas Nandakumar Review result: Almost Ready I am the assigned Gen-ART reviewer for this draft. The General Area Review Team (Gen-ART) reviews all IETF documents being processed by the IESG for the IETF Chair. Please treat these comments just like any other last call comments. For more information, please see the FAQ at <https://trac.ietf.org/trac/gen/wiki/GenArtfaq>. Document: draft-ietf-stir-oob-?? Reviewer: Suhas Nandakumar Review Date: 2019-09-16 IETF LC End Date: 2019-09-17 IESG Telechat date: Not scheduled for a telechat Summary: Thanks for a lucid document. This document is Almost Ready with few minor issues / clarifications. Major issues: None Minor issues: 1. Section 7.2 para 2 states : "The CPS responds with any such PASSporTs (assuming they exist)." Given CPS will always respond with a dummy PASSporT, the statement in the parentheses doesn't hold. 2. Section 7.4 Call flow: "Call from CS (forged caller-id info)" . Since its the attacker making the call here, we probably need to change it as "Call from Attacker (forged caller-id info)". 3. Section 7.5 has the following: Sign(K_cps, K_temp) Sign(K_temp, E(K_receiver, PASSporT)) ---> This is a clarification question for my understanding. What happens when one of the 2 messages sent gets lost when storing the PASSporT. Should we need to add any clarifications to that extent ? 4. Section 77.5 last para: clarification question Since PASSporT is encrypted at CPS , how is it aged out based on the "iat" value. Is it a function to VS to age out PASSporTs at a given CPS ? 5. Section 8.2 last part has the sentence "This document does not prescribe any particular treatment of calls that have valid PASSporTs associated with them." I wasn't sure of the intent of this sentence. Nits/editorial comments: 1. Introduction para 1: Reference to PASSporT missing 2. Introduction para 2: Xalls -> Calls 3. Section 5.2 para 1: would be nice to add reference to Section 10 4. Section 7.2 Call Flow: "Store PASSporT" --> "Store Encrypted PASSporT" 5. Section 7.2 Call Flow: "Ring phone with callerid" --> "Ring phone with verified callerid" 6. Section 8.2 Step 3: "number number" --> "number" 7. Section 8.3 para 2: "Per Step 3" --> "Per Step 3 of Section 8.1" 8. Section 10 last para: The acronyms AS and VS are used first time 9. Section 11: missing references to subcert, VIPR
