Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\))
From: Russ Housley <housley@vigilsec.com>
In-Reply-To: <F084B297-D7F3-41EE-893E-838253041DDE@chriswendt.net>
Date: Tue, 21 Feb 2017 10:45:41 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <C887D3AA-A8F8-4959-8469-497F8003385F@vigilsec.com>
References: <F084B297-D7F3-41EE-893E-838253041DDE@chriswendt.net>
To: Chris Wendt <chris-ietf@chriswendt.net>
Archived-At: <https://mailarchive.ietf.org/arch/msg/stir/m4fUXZUEkKRehldUSw1uU9GrDYg>
Cc: IETF STIR Mail List <stir@ietf.org>
Subject: Re: [stir] certificates draft - JWT claim constraints question
Precedence: list

Chris:

Yes, the inclusion of JWT Claim Constraints is OPTIONAL.

I can think ion reasons that a top-level CA might want to constrain an =
intermediate CA to a set of telephone numbers.  In this case, the =
permitted part of the extension would be used to name the set of =
telephone numbers.  The signature validation would fail is the =
intermediate CA issued a certificate outside of that set.

Russ


> On Feb 21, 2017, at 7:15 AM, Chris Wendt <chris-ietf@chriswendt.net> =
wrote:
>=20
> Just wanted to verify my understanding of the JWT Claim Constraints. =20=

>=20
> My reading of the text is that JWT Claim constraints is not mandatory, =
but can be used as an enforcement mechanism to explicitly make sure that =
any Passport object is signed with a specific set of claims, or =
explicitly does not contain certain claims.
>=20
> I=E2=80=99m also assuming that in general practice you wouldn=E2=80=99t =
include any base claims (otherwise the Passport validation would fail in =
either case) and likely only include extensions that are =
mandatory/mandatory to NOT be there from the signers perspective.
>=20
> Does this match the intention?
>=20