Re: [stir] Comments on draft-singh-stir-rph-00

["DOLLY, MARTIN C" <[e-mail]>]

Robert,

1. ok, we'll change it to, {"auth":"ets.0"}
2. there is one authority or delegate-authority per claim
3. Correct, the compact form is not allowed with this extension, and we will add explicit wording
4. we will remove the bullet
5. This depends on the "namespace": 
5a. Civil emergency (e.g., 911) is an example of use is once (on that emergency call
5b. NS/EP (ets, wps) on a per session request where the user's priority is static
5c. MCPTT, the user has a default priority level which can change dynamically based on the user's role changing (e.g., patrol person is the first at the scene of an incident, the user's priority level is elevated till the SWAT team arrives)
	We can add clarifying text

Ok with NITs

We will submit an update prior to the Internet Draft submission cut-off

Thank you,

Martin

-----Original Message-----
From: stir [mailto:[e-mail]] On Behalf Of Robert Sparks
Sent: Friday, June 16, 2017 11:18 AM
To: [e-mail]
Subject: [stir] Comments on draft-singh-stir-rph-00

1) I'm not sure why we need to the label "Resource-Priority" in

{"auth":"Resource-Priority: ets.0"}

Why isn't that simply

{"auth":"ets.0"}?

or

{"rp":"ets.0"}?

2) Clarify whether you are looking for the possibility that a different authority signs this claim or if you're always expecting this claim to be signed by the same authority as the base claims. If they can be different (and we're talking separate passports), some additional description of the verification logic is needed to help address cut-paste attacks.

3) In section 4.2, is the implication that the compact form of passport is not allowed when using this extension? If so, saying that explicitly would be better.

4) Could you say more about the first bullet in 7.2 - it's not clear it's salient to this particular spec?

5) (Minor thing, probably in the weeds) : Is there a use case in the real world now where a user gets an enhanced priority, but is only allowed to use it once? If so, this spec should call out that this mechanism doesn't restrict the user to one call. They can call as many times as they can send an INVITE within the acceptable iat window and have the assertions check out. There will be out-of-protocol consequences of course...

Nits:

The first paragraph of 7.1 has a sentence that doesn't parse starting at 
"A uniqueness of the set"

Text two bullets look like they're repeating the base spec and probably 
don't need to be here?



_______________________________________________
stir mailing list
[e-mail]
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_stir&d=DwICAg&c=LFYZ-o9_HUMeMTSQicvjIg&r=G9v8uCSSQhCmpw7ItG0r2g&m=XslLKBdaGua2zf9xq7arYhp374YsWCx-g-JuBylCC5k&s=DbmdUmAxKEidNwKqvXCqfyimvTMFL7zNWrssCpdci6I&e=