Re: [stir] Review of: draft-ietf-stir-passport-05

["Peterson, Jon" <[e-mail]>]

>JWT has nothing to do with SIP.  So when applied to a SIP context, it's
>entirely artificial.  And yes, I noted the views that thought it simpler
>or equivalent to the computed string, but could not see the explicit
>logic that made JWT a better choice, no does it seem obvious to me.
>Quite the contrary.

The only thing JWT has to do with SIP is that JWT can be a container for a
signed set of metadata and claims that might be useful in preventing
impersonation in a SIP request. JWT was chosen not because it has any
exclusive or special applicability to SIP, but instead because it could
have applicability both to SIP and other protocols.

I'm not sure I see much value in revisiting that consensus call, but I'm
sure the chairs could call it again if they see fit.

>Note that during the wg session in Berlin there was /still/ question
>about where to put the JWT information.

Kind of. It was a question about the best syntax for transporting only
part of a JWT object, and was as much a discussion about "if" as "where".
But that technical choice does not imply any discomfiture with JWT itself.

>> If you want a record of this intervention, I might point you to the Oct
>>9
>> 2015 virtual interim where this was the focus:
>>
>> https://www.ietf.org/mail-archive/web/stir/current/msg02140.html
>>
>>
>> ... and then the intense list discussion that followed hard upon it.
>
>The recording of that interim is not accessible and the very terse
>summary text of the session show nothing about an intervention.

The "intervention" is reflected in the summary text: "Chris Wendt
introduced the verified token being discussed in the IP-NNI task force."
That "verified token" was an early form of PASSporT, introducing a
JWT-based assertion. Then we can observe how "conversation focused on the
differences and similarities in what the signatures in the verified token
and RFC4474bis Identity header protected," where the latter option then
was the concatenated string I've mentioned. We made a decision there to
try to merge these into the core proposal, as the summary reads "An open
design team was formed to discuss finding a common way to address the
signaling." The design team than proceeded.

>  And 
>there was no mailing list activity for the next several days afterward.

You are absolutely correct that there were no submissions to the STIR
mailing list immediately following the interim on Friday October 9. Not a
single related email went out on Saturday the 10th, Sunday the 11th, or
even Monday October 12th (which, incidentally, was Columbus Day). Then, on
the 13th, the only mail that went out announced that the Doodle poll for
the design team had (behind the scenes) resolved, and that its first
meeting would be that coming Friday, the 16th. The day of that design call
there were 44 messages sent to the list on related subjects.

> 
>Nor do I see anything in the mailing list postings that /do/ show up
>those several days later.

I can imagine that since I had to annotate even the summary text of the
interim meeting in order to show how it related to this topic, it might
not be clear from the threads on encoding, the NNI and so on how they were
salient to these decisions if you weren't participating in the WG at the
time. Maybe looking at the design team minutes for Oct 16th would be
clearer? It at least mentioned JWT explicitly.

https://www.ietf.org/mail-archive/web/stir/current/msg02183.html

>So I've no idea what you meant by "hard upon it."

I understand you feel that progress should have been more immediate to
justify my characterization.

>Hence your explanation:
>
>      "we need to build more generically for real-time communications
>rather than just SIP."
>
>does not seem to reflected in the wg record.

Maybe you'll find the Oct 16th design team minutes clearer on this point.
Or maybe they too would require more annotation to clarify the subject and
thinking of the working group after the fact. The discussions that they
reflect, anyway, were sufficient to drive consensus at the time.

Jon Peterson
Neustar, Inc.