Re: [stir] Review of: draft-ietf-stir-rfc4474bis-10

[Dave Crocker <[e-mail]>]

On 8/18/2016 9:48 AM, Peterson, Jon wrote:
> Oh, we've allowed for multiple Identity headers for some time - the
> problem is we don't really give any reason why we allow them or any
> sense of what it might mean to have more than one. We need to say at
> least something about that, though largely this is a matter of forward
> compatibility with some future use cases that we know are under
> consideration that we don't want to rule out.


1. In the abstract, there could be different identifiers that are 
authenticated.  That's probably not supposed to be allowed for a SIP 
environment, but since there apparently can be different identifiers 
used as input to validation, perhaps it is allowed.

2. There can be different authorities used to create the authentication. 
This permits trust assessment of a combination of entities making 
validity assertions.

3. There can be different technical details to the signature.  Different 
canonicalizations, different crypto algorithms, different keys.  All of 
these might affect survival through transit and/or ability of the 
recipient to process.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net