Re: [stir] certificates draft - JWT claim constraints question

[Russ Housley <[e-mail]>]

Chris:

Yes, the inclusion of JWT Claim Constraints is OPTIONAL.

I can think ion reasons that a top-level CA might want to constrain an intermediate CA to a set of telephone numbers.  In this case, the permitted part of the extension would be used to name the set of telephone numbers.  The signature validation would fail is the intermediate CA issued a certificate outside of that set.

Russ


> On Feb 21, 2017, at 7:15 AM, Chris Wendt <[e-mail]> wrote:
> 
> Just wanted to verify my understanding of the JWT Claim Constraints.  
> 
> My reading of the text is that JWT Claim constraints is not mandatory, but can be used as an enforcement mechanism to explicitly make sure that any Passport object is signed with a specific set of claims, or explicitly does not contain certain claims.
> 
> I’m also assuming that in general practice you wouldn’t include any base claims (otherwise the Passport validation would fail in either case) and likely only include extensions that are mandatory/mandatory to NOT be there from the signers perspective.
> 
> Does this match the intention?
>