Re: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs?

[Christer Holmberg <[e-mail]>]

Hi Chris,

>> Question for clarification:
>> 
>> Section 5.2.1 of draft-passport says:
>> 
>>       "There MUST be exactly one "orig" claim with exactly one identity claim object in a PASSporT object."
>> 
>> Q1: Does the text above mean that 
>> 
>>       a) a passport must always contain one, one only one, "orig" claim; or 
>>       b) that if a passport contains an "orig" claim, if can only contains one?
>
> It can only contain one key value pair with the key “orig” and the claim value can only be one identity.
>
> In other words you cannot claim to originate multiple identities with a single passport object.

Correct. The question is whether "orig" is mandatory (alternative a) or not (alternative b). But, based on your reply to Q2 below, I assume the answer is alternative a).

I think it would be good to make that more clear. 

>> Q2: If a), does it apply to passport extensions too?
>
> All extensions must include the base passport claims and follow all rules of the claims, so yes.

I think it should be more clear whether a node can modify claims or not when adding an extension, or whether an extension needs to explicitly allow it. Currently the text only says (AFAIK) that claims cannot be removed.

For example, if I have a base passport, and add an RPH passport, I assume I cannot change the value of the "dest" claim. I would need to use a divert claim for that.

Also, as the passports may be added and signed by different authorities, and as each passport will contain the base claims, it means that the base claims will be signed multiple times, and they may be signed by different authorities. I assume that is ok.

Regards,

Christer