Re: [stir] draft-housley-stir-enhance-rfc8226-00

[Jack Rickard <[e-mail]>]

Thank you, that's really useful information.

Jack

From: stir <[e-mail]> On Behalf Of Chris Wendt
Sent: 02 February 2021 16:03
To: Jack Rickard <Jack.Rickard=[e-mail]>
Cc: IETF STIR Mail List <[e-mail]>; Russ Housley <[e-mail]>
Subject: Re: [stir] draft-housley-stir-enhance-rfc8226-00

NOTE: Message is from an external sender
Hi Jack,

We want to make sure we can easily constrain the ability for someone to add claims they are not allowed to and make them look legit, in particular this becomes more relevant with delegation (or at least this is where we hit these requirements while going through the use-cases).  So rather than just constrain the fact that you must have a particular claim, constrain the fact that they shouldn't be there. There is techniques we discussed working with current mechanisms in 8226, but we thought it might be more clear and explicit to have these new constraints.

-Chris


On Feb 2, 2021, at 6:10 AM, Jack Rickard <Jack.Rickard=[e-mail]<mailto:Jack.Rickard=[e-mail]>> wrote:

This looks fine from my point of view, however, what is the actual motivation behind this? I'd like to know why these extra constraint options need to be added before supporting it.

Thanks,
Jack

From: stir <[e-mail]<mailto:[e-mail]>> On Behalf Of Russ Housley
Sent: 21 January 2021 21:32
To: IETF STIR Mail List <[e-mail]<mailto:[e-mail]>>
Subject: [stir] draft-housley-stir-enhance-rfc8226-00

NOTE: Message is from an external sender
Please review and comment.  Christ Wendt has found some use cases where the JWT Claims Constraints in RFC 8226 are not adequate.  This I-D proposes an enhancement to make the constraints more rich.

Russ




From: [e-mail]<mailto:[e-mail]>
Subject: New Version Notification for draft-housley-stir-enhance-rfc8226-00.txt
Date: January 21, 2021 at 4:29:14 PM EST
To: "Russ Housley" <[e-mail]<mailto:[e-mail]>>


A new version of I-D, draft-housley-stir-enhance-rfc8226-00.txt
has been successfully submitted by Russ Housley and posted to the
IETF repository.

Name: draft-housley-stir-enhance-rfc8226
Revision: 00
Title: Enhanced JWT Claim Constraints for STIR Certificates
Document date: 2021-01-21
Group: Individual Submission
Pages: 8
URL:            https://www.ietf.org/archive/id/draft-housley-stir-enhance-rfc8226-00.txt<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Farchive%2Fid%2Fdraft-housley-stir-enhance-rfc8226-00.txt&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C9d522cd2662447c3112608d8c794000c%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637478785757165929%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=MCqf3m%2FXJKntDm3L9ycii13nJGcVp7Sur%2BGbWI5%2FGgU%3D&reserved=0>
Status:         https://datatracker.ietf.org/doc/draft-housley-stir-enhance-rfc8226/<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-housley-stir-enhance-rfc8226%2F&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C9d522cd2662447c3112608d8c794000c%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637478785757165929%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=6DHwyOSvkH96NbBkoVF2LHwpRWDE1s7Y0COAl8zXBrg%3D&reserved=0>
Htmlized:       https://datatracker.ietf.org/doc/html/draft-housley-stir-enhance-rfc8226<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-housley-stir-enhance-rfc8226&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C9d522cd2662447c3112608d8c794000c%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637478785757175923%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ix9dMxycNkm%2FJXikJ%2FOW5uGBFziKTMv%2Bt3NsMBnSpWs%3D&reserved=0>
Htmlized:       https://tools.ietf.org/html/draft-housley-stir-enhance-rfc8226-00<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-housley-stir-enhance-rfc8226-00&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C9d522cd2662447c3112608d8c794000c%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637478785757185916%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=CFOQvZLtetRWJ9ME98GENm%2BLKRgO4ulEeU4vz4iYLjU%3D&reserved=0>


Abstract:
  RFC 8226 provides a certificate extension to constrain the JWT claims
  that can be included in the PASSporT as defined in RFC 8225.  If the
  signer includes a JWT claim outside the constraint boundaries, then
  the recipient will reject the entire PASSporT.  This document defines
  additional ways that the JWT claims can be constrained.




Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org<https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftools.ietf.org%2F&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C9d522cd2662447c3112608d8c794000c%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637478785757185916%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=rqc%2ByDpC3XnkF415v1%2FWsNw67MvVbY7oPcSHBPCdvJE%3D&reserved=0>.

The IETF Secretariat



_______________________________________________
stir mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/stir<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fstir&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C9d522cd2662447c3112608d8c794000c%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637478785757195914%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=4YcCBQDJqeYaGIcsn9DrJyOJZTBJ1apdB491N%2FYOUL8%3D&reserved=0>