Re: [stir] Alexey Melnikov's Discuss on draft-ietf-stir-certificates-11: (with DISCUSS and COMMENT)

Alexey Melnikov <> Thu, 03 November 2016 13:37 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 01AE51299E4; Thu, 3 Nov 2016 06:37:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.72
X-Spam-Status: No, score=-2.72 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key) header.b=H2YDiWTe; dkim=pass (1024-bit key) header.b=ZIMl4nFs
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id PKEcMWvqM5ke; Thu, 3 Nov 2016 06:37:29 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id F0643129890; Thu, 3 Nov 2016 06:37:15 -0700 (PDT)
Received: from compute1.internal (compute1.nyi.internal []) by mailout.nyi.internal (Postfix) with ESMTP id 9795020860; Thu, 3 Nov 2016 09:37:13 -0400 (EDT)
Received: from web5 ([]) by compute1.internal (MEProxy); Thu, 03 Nov 2016 09:37:13 -0400
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed;; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=mesmtp; bh=6VV8VN2ugYdyLHCiIwwyexg6bu w=; b=H2YDiWTeV/jOQhKW1FRcz3o5jzrgD4+7HLTlEtFGB57wzDICfi5iXntc3G rPmnc1KdvDWnJTvPKs48i7uqUiwZ1pNpOxfj8w8tn+f5U0/JW5N3AK4fMy42f+1G ubuFPqZsSg9sETiXoAHkV8uRf1eh8t/AHaDwwlIxNcWDLCh0c=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-sender:x-me-sender:x-sasl-enc; s=smtpout; bh=6V V8VN2ugYdyLHCiIwwyexg6buw=; b=ZIMl4nFsTroSmHjd8+3sWi/t1nXGZkRENF 9ZgHfuh6j4rPzR6CosPNytjRcVdrX4dc0X4XJjKSXjsnWuPxLh3/pKhPu5x0n53w UGbyE16LXY3x1QqbaOBQ3ce6rs4zg8wWxQojApQHU1xbxC3/EpKdL5LFkRhoKmma nfilq09SU=
X-ME-Sender: <xms:iT0bWD7tmeMjGuFNB_R8UOvCHSqhk8njnbSYPkmI_-vE064oUHh12g>
Received: by mailuser.nyi.internal (Postfix, from userid 99) id 61BA45A678; Thu, 3 Nov 2016 09:37:13 -0400 (EDT)
Message-Id: <>
From: Alexey Melnikov <>
To: "Peterson, Jon" <>, Alissa Cooper <>
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain
X-Mailer: Webmail Interface - ajax-8f4ad78c
Date: Thu, 03 Nov 2016 13:37:13 +0000
In-Reply-To: <>
References: <> <> <> <> <> <> <>
Archived-At: <>
Cc: Russ Housley <>, IETF STIR Mail List <>, IESG <>,,, Robert Sparks <>
Subject: Re: [stir] Alexey Melnikov's Discuss on draft-ietf-stir-certificates-11: (with DISCUSS and COMMENT)
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Secure Telephone Identity Revisited <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 03 Nov 2016 13:37:31 -0000

On Thu, Nov 3, 2016, at 01:12 PM, Peterson, Jon wrote:
> >A followup question: what is the syntax of claim name? (I understand
> >that IA5String provides a restriction, but I am wondering if many people
> >outside of Security area actually know what these restrictions are).
> PASSporT claim names are simply JWT claim names (per stir-passport
> Section
> 5), and...
> >Are claim tokens likely to be allocated by IANA?
> ... PASSporT simply reuses the IANA allocation method of JWT, so yes, the
> claims are allocated by IANA. This is the registry.

I think this document should say so.

> To your more recent question, "I was also wondering if any of these value
> can possible contain non ASCII Unicode characters, and if they do, how
> can
> they be encoded as IA5String." If the question is "can possibly" then I'm
> not sure JWS/JWT specifically bars it (someone likely knows better than
> me, this may just devolve back to how JSON member strings are defined).
> However, I don't think any of the existing or planned registered values
> fall outside of ASCII ranges. I don't think I'd lose much sleep over it,
> given what the review processes are like and what the likely constraints
> are CAs would want to apply.

I would just add a warning about possibility to alert future readers and
Expert Reviewers.