Re: [stir] Second WGLC: draft-ietf-stir-passport-rcd-10

[Russ Housley <[e-mail]>]

Chris:

I think we want to be stronger that "little value".  I think we want to tell certificate issuers that included int "rcdi" claim in the mustExclude list would prevent the relying party from validating the integrity of the rcd.

Russ


> On May 17, 2021, at 11:19 AM, Chris Wendt <[e-mail]> wrote:
> 
> Hi Russ,
> 
> Following up on this item. How about this proposed text for security consideration section for enhance-rfc8226:
> 
> There are potentially certain PASSporT claims that are defined to be claims that enhance security or integrity for another claim.  A specific example, “rcd” and “rcdi” are claims defined in [I.D.ietf-stir-passport-rcd] where “rcdi” first depends on the existence of the “rcd” claim and “rcdi” is only serving to qualify the integrity of the information in the “rcd”, not transmit any new information.  Therefore, there is likely little value for whether “rcdi” or claims with similar properties should be included as part of the mustExclude constraint and probably considered general best practice to not include those types of claims.
> 
> Let me know if this aligns with your concern and resolves it.
> 
> -Chris
> 
> 
>> On Mar 19, 2021, at 11:45 AM, Russ Housley <[e-mail] <mailto:[e-mail]>> wrote:
>> 
>> Chris:
>>> 
>>> Thanks Russ for the review will take care of editorial/nits, discussion inline:
>>> 
>>>> On Mar 16, 2021, at 12:42 PM, Russ Housley <[e-mail] <mailto:[e-mail]>> wrote:
>>>> 
>>>> I have reviewed the document.  It is in good shape, but I have a few comments.
>>>> 
>>>> 
>>>> TECHNICAL:
>>>> 
>>>> What happens if the JWTClaimConstraints in the certificate explicitly excludes the "rcdi" claim?
>>> 
>>> 
>>> Good question, i think the easiest answer is I can’t think of a reason any authoritative certificate creator would want to do that, so question is whether we explicitly say MUST NOT do this normatively somewhere in the document?  I can do that, unless someone can come up with a scenario that excluding “rcdi” claim would be a good thing to do.  To me adding a unauthorized “rcdi” can only confirm the contents that is authorized or break the verification, so not sure there is any possibility of an attack if a “rcdi” is added by delegate signer if it’s not in mustInclude already.
>> 
>> I think a sentence or two in the Security Considerations of draft-ietf-stir-enhance-rfc8226 might be desirable.  It will need a reference to this document to be effective.  That is probably okay.
>> 
>> Russ
>> 
>