Re: [stir] Alexey Melnikov's Discuss on draft-ietf-stir-certificates-11: (with DISCUSS and COMMENT)

[Dave Crocker <[e-mail]>]

On 11/2/2016 11:41 AM, Alissa Cooper wrote:
> My understanding of the JWT Claim Constraints is that a CA can use them to constrain which claims it expects to receive when asked to validate a cert. Let’s imagine a context in which the base set of claims defined in this spec has been extended to include a “confidence” claim that allows a carrier to differentiate between cases where a number block is fully operated by a customer (e.g., Carrier X assigns a block to Enterprise Y), delegated to a wholesaler, or operating via an SBC. Imagine that the “full,” “delegated,” and “sbc” claims about a “confidence” claim have all been specified. The permitted and excluded constraints could be used to limit claims to one of these categories, e.g., permitted would be set to “full” for the claim “confidence” for numbers in the block used by Enterprise Y.


Alissa,

This presumes that claims are to be made about 'interesting' properties 
and issues, whereas the actual task the work is chartered for is far 
simpler, namely authentication of a call's identifier.

More generally, you have described here a broad model for processing 
that is to be performed by the receiver, based on these (standardized?) 
claims by the caller (or, rather, the caller's operator.)

Do you have examples of such a distributed, multi-administration policy 
and decision model being used successfully?

What has been defined and what you describe is quite a complex system.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net