[stir] "iat" value to use during PASSPorT construction

["Asveren, Tolga" <[e-mail]>]

RFC 8224 has the following in Section "4.1 PASSPorT Construction":


      Third, the JSON key "iat" MUST appear.  The authentication service

      SHOULD set the value of "iat" to an encoding of the value of the

      SIP Date header field as a JSON NumericDate (as UNIX time, per

      [RFC7519], Section 2), though an authentication service MAY set

      the value of "iat" to its own current clock time.  If the

      authentication service uses its own clock time, then the use of

      the full form of PASSporT is REQUIRED.  In either case, the

      authentication service MUST NOT generate a PASSporT for a SIP

      request if the Date header is outside of its local policy for

      freshness (sixty seconds is RECOMMENDED).

RFC 8225 has the following in Section "5.1.1 "iat" (Issued At) Claim":


   The JSON claim MUST include the "iat" (Issued At) claim ([RFC7519],

   Section 4.1.6).  As defined, the "iat" claim should be set to the

   date and time of issuance of the JWT and MUST indicate the date and

   time of the origination of the personal communications.  The time

   value should be of the NumericDate format as defined in [RFC7519],

   Section 2.  This is included for securing the token against replay

   and cut-and-paste attacks, as explained further in Section 10

   ("Security Considerations").

i- I see some conflict in RFC8225 text. It is mentioned that "iat" should be set based on issuance of JWT (which would be when PASSPorT is constructed). OTOH, it is also stated that it MUST indicate the date and time of the origination of the personal communication. The former seems to be  the right approach as what we would like to protect against cut-and-paste attacks is the PASSPorT in the context of a particular communication session. Coupling of PASSPorT with the communication session is provided through "orig"/"dest". "iat" should be set to the time of generation of PASSPorT IMHO. RFC8244 text seems to be O.K. if one accepts this interpretation as it has the notion of "local policy for freshness". The recommended value is on the very high end (anything more than a few seconds is too much in practice IMHO) but it is at least not mandating use of 60s.

ii- Aren't there legitimate cases where a communication session continues for some period of time and then due to change in its nature requires addition of PASSPorT, e.g. first there is an announcement/interaction with an automated system (which may last several minutes) and then the called-party is contacted during which PASSPorT is added (because, for example, organizational boundaries are crossed and there is a need to validate calling-party identity). For such cases there could be a legitimate and major discrepancy between Date and "current time". This is another argument in favor of considering "iat" as corresponding to PASSPorT generation rather than start of communication session IMHO. There could eb many other scenarios where similar discrepancy legitimately happens especially if one considers non-base claim types, e.g. "div".

So, the bottom line is I would like to get people's opinion about whether "iat" should pertain to the start of communication session or to the creation of PASSPorT.


Thanks,
Tolga