Subject: [Gen-art] Gen-ART Last Call review of draft-hodges-webauthn-registries-05

From: Paul Kyzivat <[email-masked]>
Date: Mon, 13 Apr 2020 14:19:03 -0400

I am the assigned Gen-ART reviewer for this draft. The General Area
Review Team (Gen-ART) reviews all IETF documents being processed
by the IESG for the IETF Chair.  Please treat these comments just
like any other last call comments.

For more information, please see the FAQ at

<https://trac.ietf.org/trac/gen/wiki/GenArtfaq>.

Document: draft-hodges-webauthn-registries-05
Reviewer: Paul Kyzivat
Review Date: 2020-04-13
IETF LC End Date: 2020-04-29
IESG Telechat date: ?

Summary:

This draft is on the right track but has open issues, described in the 
review.

Issue: Additional registry fields defined by experts

Section 2 specifies that experts are allowed to define additional fields 
to be collected in the registry. It isn't clear to me how this is 
intended to work, or could work. Some concerns that come to mind are:

* Is this on a per-registration basis? Once a new field has been 
requested, must that field be retroactively added to all preexisting 
registrations and all future entries in the registry?

* How will someone who is consulting the registry discover the meaning 
of the new fields?

* Does IANA have procedures to handle this sort of modification to the 
registries?

ISTM that the "Notes" field can already be used for extra 
format-specific data. Adding additional fields that apply to all entries 
would be better served by a formal revision to the registry.

If you really want to preserve this ability for experts to add fields 
then you need to specify in great detail how this is to work, and verify 
with IANA that it is feasible.

Otherwise the document seems ready to go.