Re: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs?

[Chris Wendt <[e-mail]>]

Hi Christer,

I guess i’m not following what’s not clear, if you MUST only have one orig claim and one identity in that claim, that seems to be pretty clear to me that you cannot either not have an orig claim or have more than one.  I guess maybe i’m missing something subtle in your point.

For extensions, and in general with any PASSporT, once the PASSporT is signed, that’s it, you cannot modify claims or "re-sign".  If you want new PASSporT claim information that you want to sign, you must have a new PASSporT or new identity header.
Currently for divert, the approach is to embed a PASSporT inside a new PASSporT, which is a valid technique also and result in a new identity header also (but you should remove the old identity header in this case).

-Chris

> On Jan 23, 2018, at 2:19 PM, Christer Holmberg <[e-mail]> wrote:
> 
> Hi Chris,
> 
>>> Question for clarification:
>>> 
>>> Section 5.2.1 of draft-passport says:
>>> 
>>>      "There MUST be exactly one "orig" claim with exactly one identity claim object in a PASSporT object."
>>> 
>>> Q1: Does the text above mean that 
>>> 
>>>      a) a passport must always contain one, one only one, "orig" claim; or 
>>>      b) that if a passport contains an "orig" claim, if can only contains one?
>> 
>> It can only contain one key value pair with the key “orig” and the claim value can only be one identity.
>> 
>> In other words you cannot claim to originate multiple identities with a single passport object.
> 
> Correct. The question is whether "orig" is mandatory (alternative a) or not (alternative b). But, based on your reply to Q2 below, I assume the answer is alternative a).
> 
> I think it would be good to make that more clear. 
> 
>>> Q2: If a), does it apply to passport extensions too?
>> 
>> All extensions must include the base passport claims and follow all rules of the claims, so yes.
> 
> I think it should be more clear whether a node can modify claims or not when adding an extension, or whether an extension needs to explicitly allow it. Currently the text only says (AFAIK) that claims cannot be removed.
> 
> For example, if I have a base passport, and add an RPH passport, I assume I cannot change the value of the "dest" claim. I would need to use a divert claim for that.
> 
> Also, as the passports may be added and signed by different authorities, and as each passport will contain the base claims, it means that the base claims will be signed multiple times, and they may be signed by different authorities. I assume that is ok.
> 
> Regards,
> 
> Christer
>