Re: [Jwt-reg-review] Review requested: draft-ietf-sipcore-rejected

[Eric Burger <[e-mail]>]

Thanks! We knew the JWS wasn’t quite right, which we were going to fix once we got this round of comments.

The reason for putting the jCard into a JWS is we (external to the IETF) have a mechanism of using the root CA of a signing certificate to ensure the integrity and identity of the entity signing the jCard. For example, one could have a policy that only an entity with the X.509 Subject of the jCard ‘Name’ can sign the jCard. Anyone else signing the card means the card is not valid. We don’t go into too many details as that sort of decision making could be seen as outside the scope of the IETF.

> On Jun 11, 2019, at 11:30 AM, Brian Campbell <[e-mail]> wrote:
> 
> Looking again at this and the more recent revision of the draft, I do think the jcard claim registration is okay in general.
> 
> However, the IANA Considerations registration request at https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-5.3 <https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-5.3> points to https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-3.2.2 <https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-3.2.2>, which I think could do a little better job of describing what the value of the jcard claim will be - particularly for folks like myself who are unfamiliar with jCard. The link back to section-5.3 is just circular and isn't particularly helpful. So I went looking to the examples to see a jcard claim to help me understand and I noticed the JWS header in https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-4.1 <https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-4.1> isn't valid JOSE/JWS, which should probably be fixed. The 'alg', 'typ', and 'x5u' header parameters should all be top level members of the JSON rather than wrapped in extra {}'s. See https://tools.ietf.org/html/rfc7515#appendix-A.1.1 <https://tools.ietf.org/html/rfc7515#appendix-A.1.1> for example.
> 
> On Sat, Mar 2, 2019 at 6:48 AM Brian Campbell <[e-mail] <mailto:[e-mail]>> wrote:
> also approve
> 
> On Sat, Mar 2, 2019 at 5:44 AM Mike Jones <Michael.Jones=[e-mail] <mailto:[e-mail]>> wrote:
> In my role as a Designated Expert, I approve this registration request.
> 
>                                 -- Mike
> 
> -----Original Message-----
> From: Jwt-reg-review <[e-mail] <mailto:[e-mail]>> On Behalf Of A. Jean Mahoney
> Sent: Thursday, February 28, 2019 2:11 PM
> To: [e-mail] <mailto:[e-mail]>
> Cc: [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>
> Subject: [Jwt-reg-review] Review requested: draft-ietf-sipcore-rejected
> 
> Hi JWT Registration Review Team,
> 
> Please review the JWT claim registration request found in Section 5.3 of draft-ietf-sipcore-rejected [1]. The draft has just finished WGLC.
> 
> Thanks!
> 
> Jean, as Doc Shepherd
> 
> [1] https://tools.ietf.org/html/draft-ietf-sipcore-rejected-03#section-5.3 <https://tools.ietf.org/html/draft-ietf-sipcore-rejected-03#section-5.3>
> 
> ------------------
> 
>  From the draft:
> 
> 
> 5.3.  JSON Web Token Claim
> 
>     This document defines the new JSON Web Token claim in the "JSON Web
>     Token Claims" sub-registry created by [RFC7519].  Section 3.2.2
>     defines the syntax.  The required information is:
> 
>     Claim Name:  jcard
> 
>     Claim Description:  jCard data
> 
>     Change Controller:  IESG
> 
>     Reference:  [RFCXXXX], [RFC7095]
> 
> _______________________________________________
> Jwt-reg-review mailing list
> [e-mail] <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/jwt-reg-review <https://www.ietf.org/mailman/listinfo/jwt-reg-review>
> 
> _______________________________________________
> Jwt-reg-review mailing list
> [e-mail] <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/jwt-reg-review <https://www.ietf.org/mailman/listinfo/jwt-reg-review>
> 
> CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited.  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.