Re: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs?

[Christer Holmberg <[e-mail]>]

Hi,

>I guess i¹m not following what¹s not clear, if you MUST only have one
>orig claim and one identity in that claim, that seems to be pretty clear
>to me that you cannot either not have an orig claim or have more than
>one.  I guess maybe i¹m missing something subtle in your point.

It is clear that you cannot have more than one claim, but I think it could
be made more clear that you always must have a claim to begin with :)

>For extensions, and in general with any PASSporT, once the PASSporT is
>signed, that¹s it, you cannot modify claims or "re-sign".  If you want
>new PASSporT claim information that you want to sign, you must have a new
>PASSporT or new identity header.

Correct, I should have made that clear.

So, if you have two (or more) Identity header fields, do they all have to
contain the same ³orig² value? Or, is one allowed to change it?

Does the same apply for ³dest²? And, if you want to change the ³dest² you
need to use the divert extension? You can¹t just add a new passport with a
new ³dest² value. Or?

>Currently for divert, the approach is to embed a PASSporT inside a new
>PASSporT, which is a valid technique also and result in a new identity
>header also (but you should remove the old identity header in this case).

My colleague Julio sent some questions and issues regarding the
³embedding²/³nesting² approach. I would be happy if you look at those :)

Regards,

Christer


>
>-Chris
>
>> On Jan 23, 2018, at 2:19 PM, Christer Holmberg
>><[e-mail]> wrote:
>> 
>> Hi Chris,
>> 
>>>> Question for clarification:
>>>> 
>>>> Section 5.2.1 of draft-passport says:
>>>> 
>>>>      "There MUST be exactly one "orig" claim with exactly one
>>>>identity claim object in a PASSporT object."
>>>> 
>>>> Q1: Does the text above mean that
>>>> 
>>>>      a) a passport must always contain one, one only one, "orig"
>>>>claim; or 
>>>>      b) that if a passport contains an "orig" claim, if can only
>>>>contains one?
>>> 
>>> It can only contain one key value pair with the key ³orig² and the
>>>claim value can only be one identity.
>>> 
>>> In other words you cannot claim to originate multiple identities with
>>>a single passport object.
>> 
>> Correct. The question is whether "orig" is mandatory (alternative a) or
>>not (alternative b). But, based on your reply to Q2 below, I assume the
>>answer is alternative a).
>> 
>> I think it would be good to make that more clear.
>> 
>>>> Q2: If a), does it apply to passport extensions too?
>>> 
>>> All extensions must include the base passport claims and follow all
>>>rules of the claims, so yes.
>> 
>> I think it should be more clear whether a node can modify claims or not
>>when adding an extension, or whether an extension needs to explicitly
>>allow it. Currently the text only says (AFAIK) that claims cannot be
>>removed.
>> 
>> For example, if I have a base passport, and add an RPH passport, I
>>assume I cannot change the value of the "dest" claim. I would need to
>>use a divert claim for that.
>> 
>> Also, as the passports may be added and signed by different
>>authorities, and as each passport will contain the base claims, it means
>>that the base claims will be signed multiple times, and they may be
>>signed by different authorities. I assume that is ok.
>> 
>> Regards,
>> 
>> Christer
>> 
>