draft-ietf-pkix-rfc2511bis-06.txt

[Ted Hardie <hardie@qualcomm.com>]

DISCUSS

In section 6, the document says that "this list may expand over time"
for controls syntax but does not indicate how.  A similar statement is
made for Publication Information Control in section 6.3.
An explicit statement of how this works is needed.

In 6.3, is the order of SinglePubInfo important?   The pubLocation looks
scary.  The client specifies an IP address:  are A and AAAA both 
allowed?

There are references in the appendices; I think it would be better
to have them all together.


Notes:

Section 2a:  for "requested" certificate fields, it would be useful to
explicitly say  which party(ies) can request.

Is section 2b: may be calculated--is this MAY be, or "is calculated"?

In section 3: This field may be calculated--is this MAY be or "is 
calculated"?


In section 4.4, the last paragraph would be better if it had an 
explicit pointer
to the threat model.