Re: [stir] [IANA #1240945] Expert review for draft-ietf-stir-passport-rcd (JWT)

[Pierce Gorman <[e-mail]>]

Appreciate the help addressing the more appropriate audience.  Thank you Ben!

Pierce


From: Ben Campbell <[e-mail]>
Sent: Wednesday, July 12, 2023 7:41 PM
To: Pierce Gorman <[e-mail]>
Cc: Richard Shockey <[e-mail]>; [e-mail]
Subject: Re: [stir] [IANA #1240945] Expert review for draft-ietf-stir-passport-rcd (JWT)

Hi,

This is a perfectly good conversation for the STIR list, but we probably don’t want to bother IANA and the various expert reviewers with it. I’ve trimmed the distribution list. Please continue with this list.

Thanks!

Ben.


On Jul 12, 2023, at 5:46 PM, Pierce Gorman <[e-mail]<mailto:[e-mail]>> wrote:

It’s like the Affordable Care Act; "We have to pass the bill so that you can find out what is in it…".  😉

I’m not asking for any changes but would appreciate some assistance understanding a couple of things around “iss”.

Section 10 covers “Third-Party Uses”.  The last paragraph is pasted below.

While in the traditional telephone network, the business relationship
between calling customers and their telephone service providers is
the ultimate root of information about a calling party's name, some
other forms of data like crowdsourced reputation scores might derive
from third parties. When those elements are present, they MUST be in
a third-party "rcd" PASSporT using "iss" claim described in the next
section.

I’m going to use a phrase from the 1st sentence in the paragraph to paraphrase the last sentence.

When those elements other forms of data like crowdsourced reputation scores are present, they MUST be in
a third-party "rcd" PASSporT using "iss" claim described in the next
section.

I feel confident I did not interpret the intent correctly.

Questions about Section 10:

In trying to understand the intent, is it OK to mentally replace the phrase “those elements” with the phrase “other forms of data like crowdsourced reputation scores”?  Surely not.

If “those elements” did not refer to “other forms of data like crowdsourced reputation scores”, what are the “elements” that may be present?

If for example an element was a “crowdsourced reputation score”, how should that be represented?

Are the elements supposed to be in the “iss” claim, or in an a third-party “rcd” PASSporT with an “iss” claim?

Section 10.1:

Midway through the 1st paragraph of Section 10.1, the following is stated:

“…the value of "iss" however MUST reflect the Subject of the certificate used to sign a third-party PASSporT. ”

I’m not sure what the definition of “reflect” is in this context.

Below is an example of a Subject of a real certificate used to sign a SHAKEN PASSporT:

        Subject: C=US, O=ATT, OU=SHAKEN, CN=SHAKEN 4036

Taken literally I suppose a reflection should be:

[image001.png]

Joking aside, a Subject is to be populated with a Distinguished Name (DN) and per RFC 5280:


Implementations of this specification MUST

   be prepared to receive the following standard attribute types in

   issuer and subject (Section 4.1.2.6<https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6>) names:



      * country,

      * organization,

      * organizational unit,

      * distinguished name qualifier,

      * state or province name,

      * common name (e.g., "Susan Housley"), and

      * serial number.



   In addition, implementations of this specification SHOULD be prepared

   to receive the following standard attribute types in issuer and

   subject names:



      * locality,

      * title,

      * surname,

      * given name,

      * initials,

      * pseudonym, and

      * generation qualifier (e.g., "Jr.", "3rd", or "IV").

Also per Section 10.1 of the RCD I-D:

An example of a Third Party issued PASSporT claims object is as follows.
{  "orig":{"tn":"12025551000"},
   "dest":{"tn":["12025551001"]},
   "iat":1443208345,
   "iss":"Zorin Industries",
   "rcd":{"nam":"James St. John Smythe"} }

If I had to guess, “Zorin Industries” would be the value of the “O=” (Organization) field of a certificate Subject DN.

In the Subject example of the real SHAKEN certificate, however, there are multiple fields, not just the Organization.  How MUST those multiple fields be “reflected”?

Best regards,

Pierce

From: stir <[e-mail]<mailto:[e-mail]>> On Behalf Of Richard Shockey
Sent: Wednesday, July 12, 2023 11:33 AM
To: Brian Campbell <bcampbell=[e-mail]<mailto:bcampbell=[e-mail]>>; [e-mail]<mailto:[e-mail]>; Michael Jones <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: Re: [stir] [IANA #1240945] Expert review for draft-ietf-stir-passport-rcd (JWT)


+1 .

Can we just get on with this?


Richard Shockey
Shockey Consulting LLC
Chairman of the Board SIP Forum
www.shockey.us<http://www.shockey.us/>
www.sipforum.org<http://www.sipforum.org/>
Save the date: Sept 12-14  www.sipnoc.org<http://www.sipnoc.org/>  (2023)
richard<at>shockey.us<http://shockey.us/>
Skype-Linkedin-Facebook –Twitter  rshockey101
PSTN [phone]


From: stir <[e-mail]<mailto:[e-mail]>> on behalf of Brian Campbell <bcampbell=[e-mail]<mailto:bcampbell=[e-mail]>>
Date: Wednesday, July 12, 2023 at 11:27 AM
To: <[e-mail]<mailto:[e-mail]>>, Michael Jones <[e-mail]<mailto:[e-mail]>>
Cc: <[e-mail]<mailto:[e-mail]>>, <[e-mail]<mailto:[e-mail]>>, <[e-mail]<mailto:[e-mail]>>, <[e-mail]<mailto:[e-mail]>>
Subject: Re: [stir] [IANA #1240945] Expert review for draft-ietf-stir-passport-rcd (JWT)

FYI Mike is now at [e-mail]<mailto:[e-mail]> (cc'd)

I looked at the -23/-26 diff and don't think another review is needed.

On Tue, Jul 11, 2023 at 7:05 PM Amanda Baber via RT <[e-mail]<mailto:[e-mail]>> wrote:
Hi Brian, John, and Mike (cc: stir),

Version -26 of this document was just approved for publication. It looks like you reviewed version -23 seven months ago:

https://datatracker.ietf.org/doc/html/draft-ietf-stir-passport-rcd

Does this need another review? We'll hold off on making the assignments until we hear back (one response is fine).

thanks,
Amanda

On Wed Nov 30 20:30:48 2022, [e-mail]<mailto:[e-mail]> wrote:
> These registrations appear to be fine.
>
> -- Mike
>
> -----Original Message-----
>  From: Amanda Baber via RT <[e-mail]<mailto:[e-mail]>>
> Sent: Monday, November 28, 2022 3:23 PM
> Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>; Mike Jones
> <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>;
> [e-mail]<mailto:[e-mail]>
> Subject: [IANA #1240945] Expert review for draft-ietf-stir-passport-
> rcd (JWT)
>
> Dear John, Brian, Michael, and Chuck (cc: stir WG),
>
> This document is on Thursday's telechat agenda:
>
> https://datatracker.ietf.org/doc/html/draft-ietf-stir-passport-rcd-23
>
> Does the new version (you likely reviewed -22) need another review? If
> we don't hear from you before Thursday, we'll mark this version of the
> document "IANA OK."
>
> thanks,
>
> Amanda Baber
> IANA Operations Manager
>
> On Wed Oct 12 21:13:11 2022, [e-mail]<mailto:[e-mail]> wrote:
> > +1
> >
> > > On Oct 11, 2022, at 3:08 PM, Mike Jones
> > > <[e-mail]<mailto:[e-mail]>>
> > > wrote:
> > >
> > > Please proceed with the registrations.
> > >
> > > Thanks,
> > > -- Mike
> > >
> > > From: David Dong via RT <[e-mail]<mailto:[e-mail]>>
> > > Sent: Tuesday, October 11, 2022 2:37:59 PM
> > >  Cc: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
> > >  <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
> > >  <[e-mail]<mailto:[e-mail]>>; Mike Jones
> > >  <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
> > > <[e-mail]<mailto:[e-mail]>>
> > >  Subject: [IANA #1240945] Expert review for draft-ietf-stir-
> > > passport-
> > > rcd
> > >
> > > Dear John, Brian, Michael, and Chuck (cc: stir WG),
> > >
> > > We see that the JWT registrations in draft-ietf-stir-passport-rcd-
> > > 21
> > > were discussed and approved on September 15th, 2022 on the mailing
> > > list at:
> > >
> > > https://mailarchive.ietf.org/arch/browse/jwt-reg-review/?q=draft-
> > >  ietf-stir-passport-rcd
> > > <https://mailarchive.ietf.org/arch/browse/jwt-
> > > reg-review/?q=draft-ietf-stir-passport-rcd>
> > >
> > > Do these registrations require another review, or are these okay to
> > > proceed?
> > >
> > > The due date is Oct 25 2022.
> > >
> > > If this is OK, when the IESG approves the document for publication,
> > > we'll make the registration at
> > >
> > > https://www.iana.org/assignments/jwt/
> > > <https://www.iana.org/assignments/jwt/>
> > >
> > > With thanks,
> > >
> > > David Dong
> > > IANA Services Specialist
> > >
>

CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited.  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you._______________________________________________ stir mailing list [e-mail]<mailto:[e-mail]> https://www.ietf.org/mailman/listinfo/stir
_______________________________________________
stir mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/stir