Re: [stir] draft-housley-stir-enhance-rfc8226-00

Hi Jack,

We want to make sure we can easily constrain the ability for someone to add claims they are not allowed to and make them look legit, in particular this becomes more relevant with delegation (or at least this is where we hit these requirements while going through the use-cases).  So rather than just constrain the fact that you must have a particular claim, constrain the fact that they shouldn’t be there. There is techniques we discussed working with current mechanisms in 8226, but we thought it might be more clear and explicit to have these new constraints.

-Chris

> On Feb 2, 2021, at 6:10 AM, Jack Rickard <Jack.Rickard=40metaswitch.com@dmarc.ietf.org> wrote:
> 
> This looks fine from my point of view, however, what is the actual motivation behind this? I'd like to know why these extra constraint options need to be added before supporting it.
>  
> Thanks,
> Jack
>  
> From: stir <stir-bounces@ietf.org <mailto:stir-bounces@ietf.org>> On Behalf Of Russ Housley
> Sent: 21 January 2021 21:32
> To: IETF STIR Mail List <stir@ietf.org <mailto:stir@ietf.org>>
> Subject: [stir] draft-housley-stir-enhance-rfc8226-00
>  
> NOTE: Message is from an external sender
> Please review and comment.  Christ Wendt has found some use cases where the JWT Claims Constraints in RFC 8226 are not adequate.  This I-D proposes an enhancement to make the constraints more rich.
>  
> Russ
>  
> 
> 
> From: internet-drafts@ietf.org <mailto:internet-drafts@ietf.org>
> Subject: New Version Notification for draft-housley-stir-enhance-rfc8226-00.txt
> Date: January 21, 2021 at 4:29:14 PM EST
> To: "Russ Housley" <housley@vigilsec.com <mailto:housley@vigilsec.com>>
>  
> 
> A new version of I-D, draft-housley-stir-enhance-rfc8226-00.txt
> has been successfully submitted by Russ Housley and posted to the
> IETF repository.
> 
> Name: draft-housley-stir-enhance-rfc8226
> Revision: 00
> Title: Enhanced JWT Claim Constraints for STIR Certificates
> Document date: 2021-01-21
> Group: Individual Submission
> Pages: 8
> URL:            https://www.ietf.org/archive/id/draft-housley-stir-enhance-rfc8226-00.txt <https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Farchive%2Fid%2Fdraft-housley-stir-enhance-rfc8226-00.txt&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663231466%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Up1Zpc7Zdsels%2BIi4BDYQaOQBMHKdNvgIR4eYWkTuSE%3D&reserved=0>
> Status:         https://datatracker.ietf.org/doc/draft-housley-stir-enhance-rfc8226/ <https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-housley-stir-enhance-rfc8226%2F&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663241455%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=W7ymLZVcTnd%2FghnUexmB4P1x1KezM8I%2BdYGANBW0u0M%3D&reserved=0>
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-housley-stir-enhance-rfc8226 <https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-housley-stir-enhance-rfc8226&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663241455%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=zxAv5QKkbF3PsWFCEe5DLtNWORCv2Cs32t4heAFEWds%3D&reserved=0>
> Htmlized:       https://tools.ietf.org/html/draft-housley-stir-enhance-rfc8226-00 <https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-housley-stir-enhance-rfc8226-00&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663251451%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Pw7YnTkYETyXDYUEBarZ1zkBkP8fGPfG4uj3cp%2BRcfM%3D&reserved=0>
> 
> 
> Abstract:
>   RFC 8226 provides a certificate extension to constrain the JWT claims
>   that can be included in the PASSporT as defined in RFC 8225.  If the
>   signer includes a JWT claim outside the constraint boundaries, then
>   the recipient will reject the entire PASSporT.  This document defines
>   additional ways that the JWT claims can be constrained.
> 
> 
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org <https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftools.ietf.org%2F&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663251451%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Pfo8cYuP9pvWiy4AuNGEnXjsCLuqd5OrC%2FIw4UL0Sw4%3D&reserved=0>.
> 
> The IETF Secretariat
> 
> 
>  
> _______________________________________________
> stir mailing list
> stir@ietf.org
> https://www.ietf.org/mailman/listinfo/stir