From: Mike Jones <Michael.Jones@microsoft.com>
To: Hannes Tschofenig <Hannes.Tschofenig@arm.com>, Roman Danyliw
 <rdd@cert.org>, "ace@ietf.org" <ace@ietf.org>
Thread-Topic: "sub" and "iss" ... RE: WGLC feedback on
 draft-ietf-ace-cwt-proof-of-possession-02
Thread-Index: AdQJ/3hMPxiML8tzRZiI8rJseWPrOAAbEEEg
Date: Fri, 22 Jun 2018 20:59:28 +0000
Message-ID: <MW2PR00MB0298B993D3D52C018A33CD7FF5750@MW2PR00MB0298.namprd00.prod.outlook.com>
References: <VI1PR0801MB2112BB6040C1328028D566F8FA750@VI1PR0801MB2112.eurprd08.prod.outlook.com>
In-Reply-To: <VI1PR0801MB2112BB6040C1328028D566F8FA750@VI1PR0801MB2112.eurprd08.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: microsoft.com does not designate
 permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 941fc550-cff6-4436-7003-08d5d8830b81
X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jun 2018 20:59:28.5548 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2PR00MB0346
Archived-At: <https://mailarchive.ietf.org/arch/msg/ace/Vij1IWYxGnA1MyDsJxC478c2KdU>
Subject: Re: [Ace] "sub" and "iss" ... RE: WGLC feedback on
 draft-ietf-ace-cwt-proof-of-possession-02
X-BeenThere: ace@ietf.org
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: "Authentication and Authorization for Constrained Environments
 \(ace\)" <ace.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ace>,
 <mailto:ace-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ace/>
List-Post: <mailto:ace@ietf.org>
List-Help: <mailto:ace-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ace>,
 <mailto:ace-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 22 Jun 2018 20:59:35 -0000

I'm working on simplifying this in a way similar to what Hannes proposed, a=
nd in a way also previously promised to Jim (removing "normally", etc.), bu=
t also in a way that makes it clear that the exactly claims to be used are =
an application-specific choice.

				-- Mike

-----Original Message-----
From: Ace <ace-bounces@ietf.org> On Behalf Of Hannes Tschofenig
Sent: Friday, June 22, 2018 6:36 AM
To: Roman Danyliw <rdd@cert.org>; ace@ietf.org
Subject: [Ace] "sub" and "iss" ... RE: WGLC feedback on draft-ietf-ace-cwt-=
proof-of-possession-02

Hi Roman,

this is also a good question:

> (3) (Editorial) Page 4, Section 3.0, I read to the end of this section by=
 which point there has been discussion of "sub" or "iss".  I was left wonde=
ring about how to interpret the case where both are present and none are.

Here is the text from the draft:

"
   The presenter can be identified in one of several ways by the CWT
   depending upon the application requirements.  If the CWT contains a
   "sub" (subject) claim [CWT], the presenter is normally the subject
   identified by the CWT.  (In some applications, the subject identifier
   will be relative to the issuer identified by the "iss" (issuer) claim
   [CWT].)  If the CWT contains no "sub" claim, the presenter is
   normally the issuer identified by the CWT using the "iss" claim.  The
   case in which the presenter is the subject of the CWT is analogous to
   Security Assertion Markup Language (SAML) 2.0
   [OASIS.saml-core-2.0-os] SubjectConfirmation usage.  At least one of
   the "sub" and "iss" claims is typically present in the CWT and some
   use cases may require that both be present.
"

The CWT PoP document does not define the subject or issuer claims.
The document also not mandate a specific set of claims to be included in a =
CWT since this is application profile specific.

Hence, I am wondering whether we could shorten the paragraph above, which i=
s actually a bit confusing.

"
This specification adds a new claim to offer the proof-of-possession functi=
onality.
There are various claims already defined and the IANA claims registry [REF]=
 contains the most up-to-date list of standardized claims. Application usin=
g the CWT functionality define what claims have to be used.

  The presenter can, if necessary, be identified in one of several ways by =
the CWT
   depending upon the application requirements.  If the CWT contains a
   "sub" (subject) claim [CWT], the presenter is the subject
   identified by the CWT. In some cases, there CWT may not include a "sub"
   claim, which allows the presenter to remain anonymous.
"

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confid=
ential and may also be privileged. If you are not the intended recipient, p=
lease notify the sender immediately and do not disclose the contents to any=
 other person, use it for any purpose, or store or copy the information in =
any medium. Thank you.

_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace