Re: [stir] [Technical Errata Reported] RFC8224 (6499)

Hi,

>Uh, I’m not sure. I’m not up to speed on this enough and certainly defer to the people that know more than me.
>
>I agree the passport is bas64url encoded, but are the strings we are talking about here done the same way? It looks like 4474 has them as base64 encoded.
>
>My read was the passport string was base64url encoded, then that string was used with combined and encoded a second time with base64 encode to go in the identity header.

There is no "encoded second time" procedure defined, afaik.

Note that while RFC 8224 defines usage of BASE64 (as indicated in the errata), the examples in Section 4.1.1 of 8224 actually use BASE64URL encoding.

   Identity: eyJhbGciOiJFUzI1NiIsInR5cCI6InBhc3Nwb3J0IiwieDV1I \
   joiaHR0cHM6Ly9jZXJ0LmV4YW1wbGUub3JnL3Bhc3Nwb3J0LmNlciJ9.eyJ \
   kZXN0Ijp7InVyaSI6WyJzaXA6YWxpY2VAZXhhbXBsZS5jb20iXX0sImlhdC \
   I6IjE0NDMyMDgzNDUiLCJvcmlnIjp7InRuIjoiMTIxNTU1NTEyMTIifX0.r \
   q3pjT1hoRwakEGjHCnWSwUnshd0-zJ6F1VOgFWSjHBr8Qjpjlk-cpFYpFYs \
   ojNCpTzO3QfPOlckGaS6hEck7w;info=<https://biloxi.example.org \
   /biloxi.cert>

   Identity: ..rq3pjT1hoRwakEGjHCnWSwUnshd0-zJ6F1VOgFWSjHBr8Qj \
   pjlk-cpFYpFYsojNCpTzO3QfPOlckGaS6hEck7w;                    \
   info=<https://biloxi.example.org/biloxi.cert>

Note the "-" (dash) character in the signature values. Dash is used in BASE64URL, but not in BASE64.

The same goes for the examples in Section 5.1.

>Anyways, I have no idea what should happen here but the more I looked at it, the less obvious it was to me.
>
> I’d love to hear from Chris ?
>
> Anyways … as a practical point, If you move the Identity header from using base64 in 4474, to base64url in 8224, it seems likely that lots of SBC will reject them.
> That will be particularly frustrating to debug given it will not reject all of them where the different characters in the alphabet don’t occur.

In general I agree that it would be an issue.

However, note that even without the change in the errata the 8224 syntax is not 100% backwards compatible with 4474 - and that is explicitly indicated in 8224, so it is not a mistake.

And, as mentioned above, the examples in 8224 are using BASE64URL encoding.

Regards,

Christer

> On Mar 28, 2021, at 10:48 AM, Russ Housley <housley@vigilsec.com> wrote:
>
> I think this errata should be approved.
>
> Russ
>
>> On Mar 27, 2021, at 4:48 PM, RFC Errata System <rfc-editor@rfc-editor.org> wrote:
>>
>> The following errata report has been submitted for RFC8224,
>> "Authenticated Identity Management in the Session Initiation Protocol (SIP)".
>>
>> --------------------------------------
>> You may review the report below and at:
>> https://protect2.fireeye.com/v1/url?k=190c118c-4697288e-190c5117-869a
>> 14f4b08c-ac8e6db5f0d29493&q=1&e=4efdaf80-a661-41c1-8b98-b6dad7d3e0b7&
>> u=https%3A%2F%2Fwww.rfc-editor.org%2Ferrata%2Feid6499
>>
>> --------------------------------------
>> Type: Technical
>> Reported by: Marc Petit-Huguenin <marc@petit-huguenin.org>
>>
>> Section: 4
>>
>> Original Text
>> -------------
>> Identity = "Identity" HCOLON signed-identity-digest SEMI
>>         ident-info *( SEMI ident-info-params ) signed-identity-digest
>> = 1*(base64-char / ".") ident-info = "info" EQUAL ident-info-uri
>> ident-info-uri = LAQUOT absoluteURI RAQUOT ident-info-params =
>> ident-info-alg / ident-type /
>>   ident-info-extension
>> ident-info-alg = "alg" EQUAL token
>> ident-type = "ppt" EQUAL token
>> ident-info-extension = generic-param
>>
>> base64-char = ALPHA / DIGIT / "/" / "+"
>>
>>
>> Corrected Text
>> --------------
>> Identity = "Identity" HCOLON signed-identity-digest SEMI
>>         ident-info *( SEMI ident-info-params ) signed-identity-digest
>> = 1*(base64url-char / ".") ident-info = "info" EQUAL ident-info-uri
>> ident-info-uri = LAQUOT absoluteURI RAQUOT ident-info-params =
>> ident-info-alg / ident-type /
>>   ident-info-extension
>> ident-info-alg = "alg" EQUAL token
>> ident-type = "ppt" EQUAL token
>> ident-info-extension = generic-param
>>
>> base64url-char = ALPHA / DIGIT / "-" / "_"
>>
>>
>> Notes
>> -----
>> RFC 8225 makes it clear that the encoding is BASE4URL, not the standard BASE64 encoding.
>>
>> Instructions:
>> -------------
>> This erratum is currently posted as "Reported". If necessary, please
>> use "Reply All" to discuss whether it should be verified or rejected.
>> When a decision is reached, the verifying party can log in to change
>> the status and edit the report, if necessary.
>>
>> --------------------------------------
>> RFC8224 (draft-ietf-stir-rfc4474bis-16)
>> --------------------------------------
>> Title               : Authenticated Identity Management in the Session Initiation Protocol (SIP)
>> Publication Date    : February 2018
>> Author(s)           : J. Peterson, C. Jennings, E. Rescorla, C. Wendt
>> Category            : PROPOSED STANDARD
>> Source              : Secure Telephone Identity Revisited
>> Area                : Applications and Real-Time
>> Stream              : IETF
>> Verifying Party     : IESG
>>
>> _______________________________________________
>> stir mailing list
>> stir@ietf.org
>> https://www.ietf.org/mailman/listinfo/stir
>

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir