Re: [stir] [IANA #1240945] Expert review for draft-ietf-stir-passport-rcd (JWT)

[Ben Campbell <[e-mail]>]

Hi,

This is a perfectly good conversation for the STIR list, but we probably don’t want to bother IANA and the various expert reviewers with it. I’ve trimmed the distribution list. Please continue with this list.

Thanks!

Ben.

> On Jul 12, 2023, at 5:46 PM, Pierce Gorman <[e-mail]> wrote:
> 
> It’s like the Affordable Care Act; "We have to pass the bill so that you can find out what is in it…".  😉
>  
> I’m not asking for any changes but would appreciate some assistance understanding a couple of things around “iss”.
>  
> Section 10 covers “Third-Party Uses”.  The last paragraph is pasted below.
>  
> While in the traditional telephone network, the business relationship
> between calling customers and their telephone service providers is
> the ultimate root of information about a calling party's name, some
> other forms of data like crowdsourced reputation scores might derive
> from third parties. When those elements are present, they MUST be in
> a third-party "rcd" PASSporT using "iss" claim described in the next
> section.
>  
> I’m going to use a phrase from the 1st sentence in the paragraph to paraphrase the last sentence.
>  
> When those elements other forms of data like crowdsourced reputation scores are present, they MUST be in
> a third-party "rcd" PASSporT using "iss" claim described in the next
> section.
>  
> I feel confident I did not interpret the intent correctly.
>  
> Questions about Section 10:
>  
> In trying to understand the intent, is it OK to mentally replace the phrase “those elements” with the phrase “other forms of data like crowdsourced reputation scores”?  Surely not.
>  
> If “those elements” did not refer to “other forms of data like crowdsourced reputation scores”, what are the “elements” that may be present?
>  
> If for example an element was a “crowdsourced reputation score”, how should that be represented?
>  
> Are the elements supposed to be in the “iss” claim, or in an a third-party “rcd” PASSporT with an “iss” claim?
>  
> Section 10.1:
>  
> Midway through the 1st paragraph of Section 10.1, the following is stated:
>  
> “…the value of "iss" however MUST reflect the Subject of the certificate used to sign a third-party PASSporT. ”
>  
> I’m not sure what the definition of “reflect” is in this context.
>  
> Below is an example of a Subject of a real certificate used to sign a SHAKEN PASSporT:
>  
>         Subject: C=US, O=ATT, OU=SHAKEN, CN=SHAKEN 4036
>  
> Taken literally I suppose a reflection should be:
>  

>  
> Joking aside, a Subject is to be populated with a Distinguished Name (DN) and per RFC 5280:
>  
> Implementations of this specification MUST
>    be prepared to receive the following standard attribute types in
>    issuer and subject (Section 4.1.2.6 <https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6>) names:
>  
>       * country,
>       * organization,
>       * organizational unit,
>       * distinguished name qualifier,
>       * state or province name,
>       * common name (e.g., "Susan Housley"), and
>       * serial number.
>  
>    In addition, implementations of this specification SHOULD be prepared
>    to receive the following standard attribute types in issuer and
>    subject names:
>  
>       * locality,
>       * title,
>       * surname,
>       * given name,
>       * initials,
>       * pseudonym, and
>       * generation qualifier (e.g., "Jr.", "3rd", or "IV").
>  
> Also per Section 10.1 of the RCD I-D:
>  
> An example of a Third Party issued PASSporT claims object is as follows.
> {  "orig":{"tn":"12025551000"},
>    "dest":{"tn":["12025551001"]},
>    "iat":1443208345,
>    "iss":"Zorin Industries",
>    "rcd":{"nam":"James St. John Smythe"} }
>  
> If I had to guess, “Zorin Industries” would be the value of the “O=” (Organization) field of a certificate Subject DN.
>  
> In the Subject example of the real SHAKEN certificate, however, there are multiple fields, not just the Organization.  How MUST those multiple fields be “reflected”?
>  
> Best regards,
>  
> Pierce
>  
> From: stir <[e-mail] <mailto:[e-mail]>> On Behalf Of Richard Shockey
> Sent: Wednesday, July 12, 2023 11:33 AM
> To: Brian Campbell <bcampbell=[e-mail] <mailto:bcampbell=[e-mail]>>; [e-mail] <mailto:[e-mail]>; Michael Jones <[e-mail] <mailto:[e-mail]>>
> Cc: [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>
> Subject: Re: [stir] [IANA #1240945] Expert review for draft-ietf-stir-passport-rcd (JWT)
>  
>  
> +1 .
>  
> Can we just get on with this?
>  
>  
> Richard Shockey
> Shockey Consulting LLC
> Chairman of the Board SIP Forum
> www.shockey.us <http://www.shockey.us/>
> www.sipforum.org <http://www.sipforum.org/>
> Save the date: Sept 12-14  www.sipnoc.org <http://www.sipnoc.org/>  (2023)
> richard<at>shockey.us <http://shockey.us/>
> Skype-Linkedin-Facebook –Twitter  rshockey101
> PSTN [phone]
>  
>  
> From: stir <[e-mail] <mailto:[e-mail]>> on behalf of Brian Campbell <bcampbell=[e-mail] <mailto:bcampbell=[e-mail]>>
> Date: Wednesday, July 12, 2023 at 11:27 AM
> To: <[e-mail] <mailto:[e-mail]>>, Michael Jones <[e-mail] <mailto:[e-mail]>>
> Cc: <[e-mail] <mailto:[e-mail]>>, <[e-mail] <mailto:[e-mail]>>, <[e-mail] <mailto:[e-mail]>>, <[e-mail] <mailto:[e-mail]>>
> Subject: Re: [stir] [IANA #1240945] Expert review for draft-ietf-stir-passport-rcd (JWT)
>  
> FYI Mike is now at [e-mail] <mailto:[e-mail]> (cc'd) 
>  
> I looked at the -23/-26 diff and don't think another review is needed.
>  
> On Tue, Jul 11, 2023 at 7:05 PM Amanda Baber via RT <[e-mail] <mailto:[e-mail]>> wrote:
> Hi Brian, John, and Mike (cc: stir),
> 
> Version -26 of this document was just approved for publication. It looks like you reviewed version -23 seven months ago:
> 
> https://datatracker.ietf.org/doc/html/draft-ietf-stir-passport-rcd
> 
> Does this need another review? We'll hold off on making the assignments until we hear back (one response is fine).
> 
> thanks,
> Amanda
> 
> On Wed Nov 30 20:30:48 2022, [e-mail] <mailto:[e-mail]> wrote:
> > These registrations appear to be fine.
> > 
> > -- Mike
> > 
> > -----Original Message-----
> >  From: Amanda Baber via RT <[e-mail] <mailto:[e-mail]>>
> > Sent: Monday, November 28, 2022 3:23 PM
> > Cc: [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>; Mike Jones
> > <[e-mail] <mailto:[e-mail]>>; [e-mail] <mailto:[e-mail]>;
> > [e-mail] <mailto:[e-mail]>
> > Subject: [IANA #1240945] Expert review for draft-ietf-stir-passport-
> > rcd (JWT)
> > 
> > Dear John, Brian, Michael, and Chuck (cc: stir WG),
> > 
> > This document is on Thursday's telechat agenda:
> > 
> > https://datatracker.ietf.org/doc/html/draft-ietf-stir-passport-rcd-23
> > 
> > Does the new version (you likely reviewed -22) need another review? If
> > we don't hear from you before Thursday, we'll mark this version of the
> > document "IANA OK."
> > 
> > thanks,
> > 
> > Amanda Baber
> > IANA Operations Manager
> > 
> > On Wed Oct 12 21:13:11 2022, [e-mail] <mailto:[e-mail]> wrote:
> > > +1
> > >
> > > > On Oct 11, 2022, at 3:08 PM, Mike Jones
> > > > <[e-mail] <mailto:[e-mail]>>
> > > > wrote:
> > > >
> > > > Please proceed with the registrations.
> > > >
> > > > Thanks,
> > > > -- Mike
> > > >
> > > > From: David Dong via RT <[e-mail] <mailto:[e-mail]>>
> > > > Sent: Tuesday, October 11, 2022 2:37:59 PM
> > > >  Cc: [e-mail] <mailto:[e-mail]> <[e-mail] <mailto:[e-mail]>>; [e-mail] <mailto:[e-mail]>
> > > >  <[e-mail] <mailto:[e-mail]>>; [e-mail] <mailto:[e-mail]>
> > > >  <[e-mail] <mailto:[e-mail]>>; Mike Jones
> > > >  <[e-mail] <mailto:[e-mail]>>; [e-mail] <mailto:[e-mail]>
> > > > <[e-mail] <mailto:[e-mail]>>
> > > >  Subject: [IANA #1240945] Expert review for draft-ietf-stir-
> > > > passport-
> > > > rcd
> > > >
> > > > Dear John, Brian, Michael, and Chuck (cc: stir WG),
> > > >
> > > > We see that the JWT registrations in draft-ietf-stir-passport-rcd-
> > > > 21
> > > > were discussed and approved on September 15th, 2022 on the mailing
> > > > list at:
> > > >
> > > > https://mailarchive.ietf.org/arch/browse/jwt-reg-review/?q=draft-
> > > >  ietf-stir-passport-rcd
> > > > <https://mailarchive.ietf.org/arch/browse/jwt-
> > > > reg-review/?q=draft-ietf-stir-passport-rcd>
> > > >
> > > > Do these registrations require another review, or are these okay to
> > > > proceed?
> > > >
> > > > The due date is Oct 25 2022.
> > > >
> > > > If this is OK, when the IESG approves the document for publication,
> > > > we'll make the registration at
> > > >
> > > > https://www.iana.org/assignments/jwt/
> > > > <https://www.iana.org/assignments/jwt/>
> > > >
> > > > With thanks,
> > > >
> > > > David Dong
> > > > IANA Services Specialist
> > > >
> > 
> 
> 
> CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited.  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you._______________________________________________ stir mailing list [e-mail] <mailto:[e-mail]> https://www.ietf.org/mailman/listinfo/stir
> _______________________________________________
> stir mailing list
> [e-mail] <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/stir