[stir] Comments on draft-singh-stir-rph-00

[Robert Sparks <[e-mail]>]

1) I'm not sure why we need to the label "Resource-Priority" in

{"auth":"Resource-Priority: ets.0"}

Why isn't that simply

{"auth":"ets.0"}?

or

{"rp":"ets.0"}?

2) Clarify whether you are looking for the possibility that a different 
authority signs this claim or if you're always expecting this claim to 
be signed by the same authority as the base claims. If they can be 
different (and we're talking separate passports), some additional 
description of the verification logic is needed to help address 
cut-paste attacks.

3) In section 4.2, is the implication that the compact form of passport 
is not allowed when using this extension? If so, saying that explicitly 
would be better.

4) Could you say more about the first bullet in 7.2 - it's not clear 
it's salient to this particular spec?

5) (Minor thing, probably in the weeds) : Is there a use case in the 
real world now where a user gets an enhanced priority, but is only 
allowed to use it once? If so, this spec should call out that this 
mechanism doesn't restrict the user to one call. They can call as many 
times as they can send an INVITE within the acceptable iat window and 
have the assertions check out. There will be out-of-protocol 
consequences of course...

Nits:

The first paragraph of 7.1 has a sentence that doesn't parse starting at 
"A uniqueness of the set"

Text two bullets look like they're repeating the base spec and probably 
don't need to be here?