[stir] AD evaluation: draft-ietf-stir-passport-09

[Alissa Cooper <[e-mail]>]

I have re-reviewed this document in preparation for IETF LC. I believe it is ready for LC and will issue the request for it shortly.

Below are some suggested clarifications that should be incorporated or otherwise addressed together with any last call comments.

= Section 3 =

OLD 
PASSporT specifically uses this token format and defines claims that convey the identity of the origination and destination of personal communications.  The originating identity, the primary value asserted in a PASSporT object represents the identity of the calling party or the initiator of a personal communications session.  The signer of a PASSporT object may or may not correspond to the origination identity.  For a given application's use or using protocol of PASSporT the creation of the PASSporT object is performed by an entity that is authoritative to assert the callers identity.  This authority is represented by the certificate credentials and the signature and PASSporT object is created and initiated to the destination(s) at the applications choice of authoritative point(s) in the network.  For example, the PASSporT object could be created at a device that has authenticated with a user, or at a network entity with an authenticated trust relationship with that device and it's user.  Destination identities represent the intended destination of the personal communications, i.e. the identity(s) being called by the caller.  The destination point(s) determined by the application need to have the capability to verify the PASSporT token and the digital signature.  The PASSporT associated certificate is used to validate the authority of the originating signer, generally via a certificate chain to the trust anchor for that application.

NEW 
PASSporT specifically uses this token format and defines claims that convey the identity of the origination and destination of personal communications.  The originating identity -- the primary value asserted in a PASSporT object -- represents the identity of the calling party or the initiator of a personal communications session.  The signer of a PASSporT object may or may not correspond to the origination identity.  For a given application's or protocol's use of PASSporT, the creation of the PASSporT object is performed by an entity that is authoritative to assert the caller's identity.  This authority is represented by the certificate credentials. The signature and PASSporT object are created at the application's choice of authoritative point(s) in the network.

For example, the PASSporT object could be created on a device to which a user has authenticated, or at a network entity with an authenticated trust relationship with that device and its user.  Destination identities represent the intended destination of the personal communications, i.e. the identities being called by the caller.  The destination point(s) determined by the application need to have the capability to verify the PASSporT token and the digital signature.  The PASSporT associated certificate is used to validate the authority of the originating signer, generally via a certificate chain to the trust anchor for that application.

= Section 5.2.1 =

s/The "dest" is a JSON object/The "dest" claim is a JSON object/

= Section 5.2.2 =

OLD
The "mky" claim value JSON array MUST
   contain JSON objects with exactly one of both corresponding "alg" and
   "dig" claim objects.  The order of the JSON array should be in
   lexicographic order of the "alg" claims first followed by the
   corresponding lexicographic order of the "dig" claim values when
   there is repeated "alg" claims.

NEW
The "mky" claim value JSON array MUST
   contain JSON objects with exactly one of both corresponding "alg" and
   "dig" claim objects.  The order of the JSON array should be in
   lexicographic order of the "alg" claims. If the array contains multiple identical "alg" claims, those should be ordered in the lexicographic order of their associated "dig" claims.
   
= Section 7 =
   
s/the Compact form/the compact form/

s/In order to construct the Compact form of the PASSporT string, the/In order to construct the Compact form of the PASSporT string, follow the/