Re: [stir] Second WGLC: draft-ietf-stir-passport-rcd-10

[Russ Housley <[e-mail]>]

Chris:
> 
> Thanks Russ for the review will take care of editorial/nits, discussion inline:
> 
>> On Mar 16, 2021, at 12:42 PM, Russ Housley <[e-mail]> wrote:
>> 
>> I have reviewed the document.  It is in good shape, but I have a few comments.
>> 
>> 
>> TECHNICAL:
>> 
>> What happens if the JWTClaimConstraints in the certificate explicitly excludes the "rcdi" claim?
> 
> 
> Good question, i think the easiest answer is I can’t think of a reason any authoritative certificate creator would want to do that, so question is whether we explicitly say MUST NOT do this normatively somewhere in the document?  I can do that, unless someone can come up with a scenario that excluding “rcdi” claim would be a good thing to do.  To me adding a unauthorized “rcdi” can only confirm the contents that is authorized or break the verification, so not sure there is any possibility of an attack if a “rcdi” is added by delegate signer if it’s not in mustInclude already.

I think a sentence or two in the Security Considerations of draft-ietf-stir-enhance-rfc8226 might be desirable.  It will need a reference to this document to be effective.  That is probably okay.

Russ