Re: [Ace] "sub" and "iss" ... RE: WGLC feedback on draft-ietf-ace-cwt-proof-of-possession-02

Roman Danyliw <rdd@cert.org> Tue, 26 June 2018 01:54 UTC

Return-Path: <rdd@cert.org>
X-Original-To: ace@ietfa.amsl.com
Delivered-To: ace@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6EA89130F47 for <ace@ietfa.amsl.com>; Mon, 25 Jun 2018 18:54:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q6YtbbHJDQUf for <ace@ietfa.amsl.com>; Mon, 25 Jun 2018 18:54:50 -0700 (PDT)
Received: from taper.sei.cmu.edu (taper.sei.cmu.edu [147.72.252.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C53E7130E7A for <ace@ietf.org>; Mon, 25 Jun 2018 18:54:50 -0700 (PDT)
Received: from korb.sei.cmu.edu (korb.sei.cmu.edu [10.64.21.30]) by taper.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id w5Q1sYlf029384; Mon, 25 Jun 2018 21:54:34 -0400
DKIM-Filter: OpenDKIM Filter v2.11.0 taper.sei.cmu.edu w5Q1sYlf029384
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cert.org; s=yc2bmwvrj62m; t=1529978074; bh=YeyK9Vy11geO62T/JkOy1ID7K4WIG/Lpqrot17iUAdY=; h=From:To:Subject:Date:References:In-Reply-To:From; b=A/183994UbuMEI0unkOAscogfUYzphuxwZcW8b4wlF6lmkdae0c2tXWRmdy87lJ4/ DpzMzxI5NmHizuTeK+iKEKIx/YPF3tuL4eydNBA9ci9VEkFNpH5I2QT/2EfCiJ1RiU 2aOT+g38HwUs7f2pZAf4VWCBt2ObYeHsOA96LzSs=
Received: from CASCADE.ad.sei.cmu.edu (cascade.ad.sei.cmu.edu [10.64.28.248]) by korb.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id w5Q1sWXY012277; Mon, 25 Jun 2018 21:54:32 -0400
Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASCADE.ad.sei.cmu.edu ([10.64.28.248]) with mapi id 14.03.0399.000; Mon, 25 Jun 2018 21:54:32 -0400
From: Roman Danyliw <rdd@cert.org>
To: Hannes Tschofenig <Hannes.Tschofenig@arm.com>, "ace@ietf.org" <ace@ietf.org>
Thread-Topic: "sub" and "iss" ... RE: WGLC feedback on draft-ietf-ace-cwt-proof-of-possession-02
Thread-Index: AdQJ/3hMPxiML8tzRZiI8rJseWPrOAC8HqIQ
Date: Tue, 26 Jun 2018 01:54:31 +0000
Message-ID: <359EC4B99E040048A7131E0F4E113AFC014C3F3BCC@marathon>
References: <VI1PR0801MB2112BB6040C1328028D566F8FA750@VI1PR0801MB2112.eurprd08.prod.outlook.com>
In-Reply-To: <VI1PR0801MB2112BB6040C1328028D566F8FA750@VI1PR0801MB2112.eurprd08.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.64.22.6]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/ace/NGHxlj8bbchC5_B_cVw_oz5zbyI>
Subject: Re: [Ace] "sub" and "iss" ... RE: WGLC feedback on draft-ietf-ace-cwt-proof-of-possession-02
X-BeenThere: ace@ietf.org
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" <ace.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ace>, <mailto:ace-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ace/>
List-Post: <mailto:ace@ietf.org>
List-Help: <mailto:ace-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ace>, <mailto:ace-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Jun 2018 01:54:56 -0000

Hi Hannes!

> -----Original Message-----
> From: Hannes Tschofenig [mailto:Hannes.Tschofenig@arm.com]
> Sent: Friday, June 22, 2018 9:36 AM
> To: Roman Danyliw <rdd@cert.org>; ace@ietf.org
> Subject: "sub" and "iss" ... RE: WGLC feedback on draft-ietf-ace-cwt-proof-of-
> possession-02
> 
> Hi Roman,
> 
> this is also a good question:
> 
> > (3) (Editorial) Page 4, Section 3.0, I read to the end of this section by which
> point there has been discussion of "sub" or "iss".  I was left wondering about
> how to interpret the case where both are present and none are.
> 
> Here is the text from the draft:
> 
> "
>    The presenter can be identified in one of several ways by the CWT
>    depending upon the application requirements.  If the CWT contains a
>    "sub" (subject) claim [CWT], the presenter is normally the subject
>    identified by the CWT.  (In some applications, the subject identifier
>    will be relative to the issuer identified by the "iss" (issuer) claim
>    [CWT].)  If the CWT contains no "sub" claim, the presenter is
>    normally the issuer identified by the CWT using the "iss" claim.  The
>    case in which the presenter is the subject of the CWT is analogous to
>    Security Assertion Markup Language (SAML) 2.0
>    [OASIS.saml-core-2.0-os] SubjectConfirmation usage.  At least one of
>    the "sub" and "iss" claims is typically present in the CWT and some
>    use cases may require that both be present.
> "
> 
> The CWT PoP document does not define the subject or issuer claims.
> The document also not mandate a specific set of claims to be included in a
> CWT since this is application profile specific.
> 
> Hence, I am wondering whether we could shorten the paragraph above,
> which is actually a bit confusing.
> 
> "
> This specification adds a new claim to offer the proof-of-possession
> functionality.
> There are various claims already defined and the IANA claims registry [REF]
> contains the most up-to-date list of standardized claims. Application using
> the CWT functionality define what claims have to be used.
> 
>   The presenter can, if necessary, be identified in one of several ways by the
> CWT
>    depending upon the application requirements.  If the CWT contains a
>    "sub" (subject) claim [CWT], the presenter is the subject
>    identified by the CWT. In some cases, there CWT may not include a "sub"
>    claim, which allows the presenter to remain anonymous.
> "

I like this shortened paragraph proposed above.  IMO, it's simpler and more appropriate in this draft.

Thanks,
Roman

> Ciao
> Hannes
> 
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.