Re: [stir] Alexey Melnikov's Discuss on draft-ietf-stir-certificates-11: (with DISCUSS and COMMENT)

[Sean Turner <[e-mail]>]

> On Nov 01, 2016, at 09:35, Alexey Melnikov <[e-mail]> wrote:
> 
> Alexey Melnikov has entered the following ballot position for
> draft-ietf-stir-certificates-11: Discuss
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-stir-certificates/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> I have one small issue that I would like to discuss before recommending
> approval of this document:
> 
> Reading Section 8 I was unable to figure out what are "claim",
> "permitted" and "excluded" and what exact syntaxes they use. I think this
> is underspecified.
> You are probably missing some references, examples or both.

From s5.1:

   The public key in the certificate is used to validate the signature
   on a JSON Web Token (JWT) [RFC7519] that conforms to the conventions
   specified in PASSporT [I-D.ietf-stir-passport].  This specification
   supports constraints on the JWT claims, which allows the CA to
   differentiate those enrolled from proof-of-possession versus
   delegation.

the JWT claims for STIR are found in s5 of [I-D.ietf-stir-passport].  We define our own but also use some existing ones so we could add a reference as follows to clear this up:

   …, This specification
   supports constraints on the JWT claims [I-D.ietf-stir-passport],
   which allows the CA to differentiate those enrolled from
   proof-of-possession versus delegation.

Permitted and excluded are in s8 (they’re just IA5Strings):

JWTClaimConstraint ::= SEQUENCE {
      claim IA5String,
->      permitted [1] SEQUENCE OF IA5String OPTIONAL,
->      excluded  [2] SEQUENCE OF IA5String OPTIONAL }
       ( WITH COMPONENTS { ..., permitted PRESENT } |
       WITH COMPONENTS { ..., excluded PRESENT } )

These are analogous to the permitted and excluded name and policy constraints in X.509/RFC 5280.

spt

> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> URI (RFC 3986), HTTP (RFC 7230) and HTTPS (RFC 2818) need to be Normative
> References.
> 
>