Re: [stir] Benjamin Kaduk's Discuss on draft-ietf-stir-enhance-rfc8226-03: (with DISCUSS and COMMENT)

[Russ Housley <[e-mail]>]

Thanks Jon.

I understand that the EnhancedJWTClaimConstraints extension will support certificate delegation as well as other things.  In an 0ff-list message, I learned that the ATIS will be mandating support for the EnhancedJWTClaimConstraints extension in one of their documents.  So, this approach seems to be on target.

Russ

> On Jun 30, 2021, at 11:37 AM, Peterson, Jon <jon.peterson=[e-mail]> wrote:
> 
> 
> I don't know that enhanced constraints need to be coupled that tightly to delegation. When delegation gets approved in the SHAKEN ecosystem (I wouldn't venture when exactly that will be), it would certainly make sense for SHAKEN specs to point to the enhanced constraints, but I'm not sure there's something we need to close in the IETF to make that possible. I think your Section 6 text looks fine. I guess I can also imagine non-delegation cases that could use enhanced constraints in the future as well, so I wouldn't necessarily want to make them so intertwined.
> 
> Jon Peterson
> Neustar, Inc.
> 
> On 6/29/21, 2:34 PM, "stir on behalf of Russ Housley" <[e-mail] on behalf of [e-mail]> wrote:
> 
>    Based on the comments from Ben Kaduk, I drafted the below guidance to CAs.
> 
>> 6.  Guidance to Certification Authorities
>> 
>> The EnhancedJWTClaimConstraints extension specified in this document
>> and the JWTClaimConstraints extension specified in [RFC8226] MUST NOT
>> both appear in the same certificate.
>> 
>> If the situation calls for mustExclude constraints, then the
>> EnhancedJWTClaimConstraints extension is the only extension that can
>> express the constraints.
>> 
>> On the other hand, if the situation does not call for mustExclude
>> constraints, then either the EnhancedJWTClaimConstraints extension or
>> the JWTClaimConstraints extension can express the constraints.  Until
>> such time as the EnhancedJWTClaimConstraints become widely
>> implemented, the use of the JWTClaimConstraints extension may be more
>> likely to be implemented.  This guess is based on the presumption
>> that the first specified extension will be implemented more widely in
>> the next few years.
> 
> 
>    The delegated certs activities lead to this document in the first place, so it seems appropriate to ask when people think that delegate certificates will be implement?  Will a future version of the delegated certificates document mandate the implementation of the EnhancedJWTClaimConstraints extension?  Do these answers to these questions offer any better guidance than the above?
> 
>    Russ
>