Re: [stir] Ben Campbell's Yes on draft-ietf-stir-rfc4474bis-15: (with COMMENT)

Alexey Melnikov <> Thu, 03 November 2016 08:37 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 9FEF0129478; Thu, 3 Nov 2016 01:37:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.72
X-Spam-Status: No, score=-2.72 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key) header.b=qnKOgQZL; dkim=pass (1024-bit key) header.b=m30FC6ke
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id h-IS3vaAaVE8; Thu, 3 Nov 2016 01:37:22 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id F20F01204D9; Thu, 3 Nov 2016 01:37:21 -0700 (PDT)
Received: from compute6.internal (compute6.nyi.internal []) by mailout.nyi.internal (Postfix) with ESMTP id 605DB20717; Thu, 3 Nov 2016 04:37:21 -0400 (EDT)
Received: from frontend1 ([]) by compute6.internal (MEProxy); Thu, 03 Nov 2016 04:37:21 -0400
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed;; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc:x-sasl-enc; s=mesmtp; bh=UU3XQaTLvMiY1ze a3YKY5ZW5rh4=; b=qnKOgQZLzoRrB/g9RI/vL5I+PLr2PoTkcBf40vHe4qaUcAV 3C0XN/YdRZnN+5axhfzAM3jhQTmJb1i5ZovVi8d8E0c34hS/z3oFZrU5LpNScTr4 TKSzKJ2xNokfdtytytwq8y7XxTGqz+MO3ecejGpfOOoyULpHJyJGrOvTjzZA=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-sender:x-me-sender:x-sasl-enc:x-sasl-enc; s= smtpout; bh=UU3XQaTLvMiY1zea3YKY5ZW5rh4=; b=m30FC6keRx3NUceslT3n GhmSJ9nPWrvn0o74E2po8MC7qAekgALI/XOI87o2vcCAnm98c9996Jnu2NdgoEEj Cjxq3R1UrkRSVvBnXcvEo/6cQC8/1JqEU+zRiHyZCodbxJQxj+1T5KUsyTLXkWO9 slRHV+wnLgycI+XQ2+Ve3aQ=
X-ME-Sender: <xms:QfcaWKZu1iNumYuVEyumKivfKaKlrHYjRqAm8nxqbvVS6hkx-HbZJA>
X-Sasl-enc: ZuVYctqYg0+UPyynTSYglEcMZRNiYllaE/lCOw1QhIPQ 1478162240
Received: from [] (unknown []) by (Postfix) with ESMTPA id EC737F29CC; Thu, 3 Nov 2016 04:37:20 -0400 (EDT)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (1.0)
From: Alexey Melnikov <>
X-Mailer: iPhone Mail (13G35)
In-Reply-To: <>
Date: Thu, 03 Nov 2016 08:42:29 +0000
Content-Transfer-Encoding: 7bit
Message-Id: <>
References: <>
To: Ben Campbell <>
Archived-At: <>
Cc:,,, The IESG <>,
Subject: Re: [stir] Ben Campbell's Yes on draft-ietf-stir-rfc4474bis-15: (with COMMENT)
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Secure Telephone Identity Revisited <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 03 Nov 2016 08:37:24 -0000

Hi Ben,
A couple of comments on your comments.

> On 2 Nov 2016, at 23:38, Ben Campbell <> wrote:
> - 6.2, step 4:  This says that if the full form of passport is included,
> and the Date header and iat do not match, use iat if it is fresh. I'm
> curious why not just use iat in the first place?

Good point.

> What should one do if
> Date is fresh, but iat is not?

Then it might be a cut & paste attack.

> -6.2.2: This section recommends specific result code reason phrases for a
> couple of circumstances. I assume the idea is that one should use a
> "helpful" reason phrase, and these are examples of phrases helpful for
> the circumstances. But it reads as if you mean to standardize those
> specific reason phrases.  If the intent is really to offer examples,
> please clarify. I'd hate to see us back in the days of commonly seeing
> SIP code break due to unexpected reason phrases.

This essentially a better version of my comment.