Re: [stir] Comments on draft-peterson-stir-cnam-02

["Peterson, Jon" <[e-mail]>]

Thanks for nits and notes, definitely we should keep straight what we mean
by third parties here.

>In the context of the discussion at "Relying parties in STIR have always
>been left to make thier own authorization decisions": It's not yet clear
>to me from the text that we require _both_ an attestation of "orig" from
>a proper authority and an attestation of "cnam", especially when the
>authorities are different. What text do we have that keeps a pasted
>cnam passport with some non-matching "orig" from being treated as valid?

What we're trying to do by having "orig" and "cnam" under a signature from
the same authority is to bind the "cna" to the call from a particular
number (or whatever originating identifier) that someone is trying to set
up. I mean, for the third party case we could effectively use a different
claim to represent the telephone number, one that doesn't have the
semantics of "this is the originator of a telephone call" - like say the
JWT claim for phone_number already in the IANA registry. But the design
goal here is to mirror the syntax of the first party case here, and also
to make it clear that the third-party "cna" is data about a -call-, not
just a number. Maybe if we made that distinction clearer in the text, it
would help explain the design rationale.

>It would be good to specify _where_ in the IANA registries to put the
>CNA types registry. (We put the extension name registry too high in the
>hierarchy perhaps.)

Roger.

Jon Peterson
Neustar, Inc.