[stir] review draft-ietf-stir-rfc4474bis-14

[Jim Schaad <[e-mail]>]

Section 3 - I am not sure that it is correct to say the following
"an authentication service   constructs tokens based on the PASSporT
[I-D.ietf-stir-passport]   format, a JSON [RFC7159] object"

PASSporT is not producing a JSON object.  More correct would be to say "an
authentication service using PASSporT tokens, a value that uses JSON objects
with values derived from ..."

Section 4.1 - You have managed to miss a step in the procedure for "orig".
Unless things are changed there is no way to populate a "tn" claim in an
array, a JSON object is required as well.

Section 4.1 - I believe that the procedures for doing "iat" are incorrect as
this is a number not a quoted value.

Section 4.1 - If the authentication service uses its own clock time, are
there any requirements that either a compressed PASSporT not be used or the
SIP date header be updated?

Section 6.2.3 - This section leaves me unclear about what comparisons of the
values in the passport are required to be compared against the values in the
SIP header.  It appears that checking the telephone numbers is only a MAY.
Do the fields in the PASSporT become authoritive and you ignore the header
fields?

Jim