[stir] A few comments on the PASSporT Document

[Russ Housley <[e-mail]>]

I needed to chase a bunch of references to figure out what really goes in the iat claim.  This leads me to two comments.

(1)  Let’s help the reader and tell them that the iat claim contains a JSON numeric value representing the number of seconds from 1970-01-01 00:00:00 UTC.

(2) The iat claim carries the time that the token was issued.  Section 7 tells that the token should be handled in a "reasonable for clock drift and transmission time.”  This makes sense, but neither Section 3.2.1.1 nor Section 7 tells what ought to happen if it is determined to be stale.

The syntax of the mky claim seems to go against a JOSE design principle.  JOSE used very compact representations for everything.  However, the mky claim uses a whole lot of colons.  This leads to a third comment.

(3) To align with the JOSE principle, should the mky claim syntax use a hex string or a base64 string to carry the hash values.

Thanks,
  Russ