From: Russ Housley <housley@vigilsec.com>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable
Message-Id: <9D68E244-1E03-4FF1-8343-F661FF3D629D@vigilsec.com>
Date: Thu, 21 Apr 2016 13:44:37 -0400
To: IETF STIR Mail List <stir@ietf.org>
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
Archived-At: <http://mailarchive.ietf.org/arch/msg/stir/OyaCIduI1TNV_tPXiWbOpYhBr9s>
Subject: [stir] A few comments on the PASSporT Document
Precedence: list

I needed to chase a bunch of references to figure out what really goes =
in the iat claim.  This leads me to two comments.

(1)  Let=92s help the reader and tell them that the iat claim contains a =
JSON numeric value representing the number of seconds from 1970-01-01 =
00:00:00 UTC.

(2) The iat claim carries the time that the token was issued.  Section 7 =
tells that the token should be handled in a "reasonable for clock drift =
and transmission time.=94  This makes sense, but neither Section 3.2.1.1 =
nor Section 7 tells what ought to happen if it is determined to be =
stale.

The syntax of the mky claim seems to go against a JOSE design principle. =
 JOSE used very compact representations for everything.  However, the =
mky claim uses a whole lot of colons.  This leads to a third comment.

(3) To align with the JOSE principle, should the mky claim syntax use a =
hex string or a base64 string to carry the hash values.

Thanks,
  Russ