Re: [stir] [Technical Errata Reported] RFC8224 (6499)

@Chris …. 

Uh, I’m not sure. I’m not up to speed on this enough and certainly defer to the people that know more than me. 

I agree the passport is bas64url encoded, but are the strings we are talking about here done the same way? It looks like 4474 has them as base64 encoded. 

My read was the passport string was base64url encoded, then that string was used with combined and encdoed a second time with base64 encode to go in the identity header.

Anyways, I have no idea what should happen here but the more I looked at it, the less obvious it was to me. 

 I’d love to hear from Chris ?

Anyways … as a practical point, If you move the Identity header from using base64 in 4474, to base64url in 8224, it seems likely that lots of SBC will reject them. That will be particularly frustrating to debug given it will not reject all of them where the different characters in the alphabet don’t occur. 

> On Mar 28, 2021, at 10:48 AM, Russ Housley <housley@vigilsec.com> wrote:
> 
> I think this errata should be approved.
> 
> Russ
> 
>> On Mar 27, 2021, at 4:48 PM, RFC Errata System <rfc-editor@rfc-editor.org> wrote:
>> 
>> The following errata report has been submitted for RFC8224,
>> "Authenticated Identity Management in the Session Initiation Protocol (SIP)".
>> 
>> --------------------------------------
>> You may review the report below and at:
>> https://www.rfc-editor.org/errata/eid6499
>> 
>> --------------------------------------
>> Type: Technical
>> Reported by: Marc Petit-Huguenin <marc@petit-huguenin.org>
>> 
>> Section: 4
>> 
>> Original Text
>> -------------
>> Identity = "Identity" HCOLON signed-identity-digest SEMI
>>         ident-info *( SEMI ident-info-params )
>> signed-identity-digest = 1*(base64-char / ".")
>> ident-info = "info" EQUAL ident-info-uri
>> ident-info-uri = LAQUOT absoluteURI RAQUOT
>> ident-info-params = ident-info-alg / ident-type /
>>   ident-info-extension
>> ident-info-alg = "alg" EQUAL token
>> ident-type = "ppt" EQUAL token
>> ident-info-extension = generic-param
>> 
>> base64-char = ALPHA / DIGIT / "/" / "+"
>> 
>> 
>> Corrected Text
>> --------------
>> Identity = "Identity" HCOLON signed-identity-digest SEMI
>>         ident-info *( SEMI ident-info-params )
>> signed-identity-digest = 1*(base64url-char / ".")
>> ident-info = "info" EQUAL ident-info-uri
>> ident-info-uri = LAQUOT absoluteURI RAQUOT
>> ident-info-params = ident-info-alg / ident-type /
>>   ident-info-extension
>> ident-info-alg = "alg" EQUAL token
>> ident-type = "ppt" EQUAL token
>> ident-info-extension = generic-param
>> 
>> base64url-char = ALPHA / DIGIT / "-" / "_"
>> 
>> 
>> Notes
>> -----
>> RFC 8225 makes it clear that the encoding is BASE4URL, not the standard BASE64 encoding.
>> 
>> Instructions:
>> -------------
>> This erratum is currently posted as "Reported". If necessary, please
>> use "Reply All" to discuss whether it should be verified or
>> rejected. When a decision is reached, the verifying party  
>> can log in to change the status and edit the report, if necessary. 
>> 
>> --------------------------------------
>> RFC8224 (draft-ietf-stir-rfc4474bis-16)
>> --------------------------------------
>> Title               : Authenticated Identity Management in the Session Initiation Protocol (SIP)
>> Publication Date    : February 2018
>> Author(s)           : J. Peterson, C. Jennings, E. Rescorla, C. Wendt
>> Category            : PROPOSED STANDARD
>> Source              : Secure Telephone Identity Revisited
>> Area                : Applications and Real-Time
>> Stream              : IETF
>> Verifying Party     : IESG
>> 
>> _______________________________________________
>> stir mailing list
>> stir@ietf.org
>> https://www.ietf.org/mailman/listinfo/stir
> 