Re: [stir] A few comments on the PASSporT Document

"Peterson, Jon" <> Thu, 21 April 2016 18:04 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id E0E6312D836 for <>; Thu, 21 Apr 2016 11:04:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -102.601
X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id JKku4IbpLcgz for <>; Thu, 21 Apr 2016 11:04:57 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 0E26512D0C1 for <>; Thu, 21 Apr 2016 11:04:56 -0700 (PDT)
Received: from pps.filterd ( []) by ( with SMTP id u3LI3RGY023956; Thu, 21 Apr 2016 14:04:56 -0400
Received: from ([]) by with ESMTP id 22bhqb27ma-1 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT); Thu, 21 Apr 2016 14:04:56 -0400
Received: from ([]) by ([::1]) with mapi id 14.03.0279.002; Thu, 21 Apr 2016 14:04:55 -0400
From: "Peterson, Jon" <>
To: Russ Housley <>, IETF STIR Mail List <>
Thread-Topic: [stir] A few comments on the PASSporT Document
Thread-Index: AQHRm/WOXRE/mgQwJkOStxpBoVrKhZ+UhmQA
Date: Thu, 21 Apr 2016 18:04:54 +0000
Message-ID: <>
References: <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
user-agent: Microsoft-MacOutlook/
x-originating-ip: []
Content-Type: text/plain; charset="iso-8859-1"
Content-ID: <>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-04-21_13:, , signatures=0
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1603290000 definitions=main-1604210285
Archived-At: <>
Subject: Re: [stir] A few comments on the PASSporT Document
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Secure Telephone Identity Revisited <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 21 Apr 2016 18:04:59 -0000

Thanks for these notes Russ.

>I needed to chase a bunch of references to figure out what really goes in
>the iat claim.  This leads me to two comments.
>(1)  Let¹s help the reader and tell them that the iat claim contains a
>JSON numeric value representing the number of seconds from 1970-01-01
>00:00:00 UTC.

Sounds good to me. That claim is defined in baseline JWS/JWT, but agreed
it would be helpful to informationally reiterate its syntax in the
PASSporT spec.

>(2) The iat claim carries the time that the token was issued.  Section 7
>tells that the token should be handled in a "reasonable for clock drift
>and transmission time.²  This makes sense, but neither Section
>nor Section 7 tells what ought to happen if it is determined to be stale.

This is where the hand-off between RFC4474bis and PASSporT can be murky.
The behavior for SIP as a using protocol of PASSporT with regards to the
freshness of Date/iat is given in RFC4474bis. Other using protocols might
want to use other means to ascertain freshness; SIP behavior really comes
down to comparing iat with the Date header, and we don't want that
using-protocol-specific language to be in PASSporT.

I can also imagine PASSporT tokens being evaluated historically, rather
than in real time, and the determination of "freshness" for those purposes
might be different, or even just irrelevant.

What we can say about iat in PASSporT though is that using protocols are
required to specify how they determine freshness (like, what they compare
it to). Would that make sense as a way to approach this?

>The syntax of the mky claim seems to go against a JOSE design principle.
>JOSE used very compact representations for everything.  However, the mky
>claim uses a whole lot of colons.  This leads to a third comment.
>(3) To align with the JOSE principle, should the mky claim syntax use a
>hex string or a base64 string to carry the hash values.

Jonathan Lennox provided some compelling reasons for us to move mky to a
JSON array format, similar to what WebRTC has done (so it's clear which
keys can match to which m= lines in SDP, say). That at least was my
take-away from the discussions around this in Buenos Aires. Would that be
satisfactory for you?

Jon Peterson
Neustar, Inc.

>  Russ
>stir mailing list