Subject: [Id-event] New revision: draft-ietf-secevent-subject-identifiers-07

From: "Richard Backman, Annabelle" <[email-masked]>
Date: Tue, 9 Mar 2021 01:46:29 +0000

Hello Security Events Working Group,

I have just published an update to the Subject Identifiers draft, making the following notable changes:

  1.  The term "Subject Identifier Type" has been replaced with "Identifier Format", and the `subject_type` member has been changed to `format`. This is part of an attempt to further emphasize the difference the fact that Subject Identifiers and Identifier Formats relate to identifiers themselves, not the subjects they identify.

     *   Note that this change applies to the IANA registry as well.

  2.  Added a section for considerations for specifications that define Identifier Formats, prohibiting them from defining rules that make assertions or declarations about the subject, rather than about the identifier.

  3.  A new format, `opaque` has been added. This is intended for scenarios where an opaque string is used as the identifier, and no additional semantics are asserted about it. (e.g., it is not to be parsed or interpreted as anything other than an identifier)

  4.  Clarified that "subject" is used in a generic sense, i.e., not specifically referring to subjects of JWTs. Also defined the term "JWT Subject" for the specific case, and updated the draft to use that when referring specifically to a subject of a JWT.

URL:            https://www.ietf.org/archive/id/draft-ietf-secevent-subject-identifiers-07.txt
Status:         https://datatracker.ietf.org/doc/draft-ietf-secevent-subject-identifiers/
Htmlized:       https://datatracker.ietf.org/doc/html/draft-ietf-secevent-subject-identifiers
Htmlized:       https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-07
Diff:           https://www.ietf.org/rfcdiff?url2=draft-ietf-secevent-subject-identifiers-07

Abstract:
  Security events communicated within Security Event Tokens may support
  a variety of identifiers to identify subjects related to the event.
  This specification formalizes the notion of subject identifiers as
  structured information that describe a subject, and named formats
  that define the syntax and semantics for encoding subject identifiers
  as JSON objects.  It also defines a registry for defining and
  allocating names for such formats, as well as the "sub_id" JSON Web
  Token (JWT) claim.

–
Annabelle Backman (she/her)
[email-masked]<mailto:[email-masked]>

---

From: Justin Richer <[email-masked]>
Date: Tue, 9 Mar 2021 16:16:35 -0500

Annabelle,

I just read through this draft, and this is great work! It always amazes me how such a small changing in framing can drastically improve a technical work. It’s much clearer as to what it’s for and how it’s used. I’m curious if this syntax change affects the existing use of this work in RISC, though? I’m not directly familiar with that group’s status.

Also, the “opaque” identifier format is precisely what we need for another project, so I’m really glad to see that included in the core.

Personally, I think this draft is ready for WGLC and on to publication.

 — Justin

> On Mar 8, 2021, at 8:46 PM, Richard Backman, Annabelle <richanna=[email-masked]> wrote:
> 
> The term "Subject Identifier Type" has been replaced with "Identifier Format", and the `subject_type` member has been changed to `format`. This is part of an attempt to further emphasize the difference the fact that Subject Identifiers and Identifier Formats relate to identifiers themselves, not the subjects they identify.
> 
> Note that this change applies to the IANA registry as well.
> 
> Added a section for considerations for specifications that define Identifier Formats, prohibiting them from defining rules that make assertions or declarations about the subject, rather than about the identifier.
> 
> A new format, `opaque` has been added. This is intended for scenarios where an opaque string is used as the identifier, and no additional semantics are asserted about it. (e.g., it is not to be parsed or interpreted as anything other than an identifier)
> 
> Clarified that "subject" is used in a generic sense, i.e., not specifically referring to subjects of JWTs. Also defined the term "JWT Subject" for the specific case, and updated the draft to use that when referring specifically to a subject of a JWT.
> 
> URL:            https://www.ietf.org/archive/id/draft-ietf-secevent-subject-identifiers-07.txt <https://www.ietf.org/archive/id/draft-ietf-secevent-subject-identifiers-07.txt>
> Status:         https://datatracker.ietf.org/doc/draft-ietf-secevent-subject-identifiers/ <https://datatracker.ietf.org/doc/draft-ietf-secevent-subject-identifiers/>
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-ietf-secevent-subject-identifiers <https://datatracker.ietf.org/doc/html/draft-ietf-secevent-subject-identifiers>
> Htmlized:       https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-07 <https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-07>
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-ietf-secevent-subject-identifiers-07 <https://www.ietf.org/rfcdiff?url2=draft-ietf-secevent-subject-identifiers-07>
> 
> Abstract:
> [email-masked] <mailto:[email-masked]>_______________________________________________
> Id-event mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/id-event

---

From: Justin Richer <[email-masked]>
Date: Wed, 10 Mar 2021 13:39:26 -0500

One more thought:

Distributed Identifiers (DIDs) are being finalized in the W3C and their use is becoming more widespread.

https://www.w3.org/TR/did-core/ <https://www.w3.org/TR/did-core/>

I would like to see “did” as a defined format in this spec. If we don’t define it now, it would be an early entry to the extension registry, so it probably makes sense to define it here. What do you and the chairs think?

 — Justin

> On Mar 9, 2021, at 4:16 PM, Justin Richer <[email-masked]> wrote:
> 
> Annabelle,
> 
>> On Mar 8, 2021, at 8:46 PM, Richard Backman, Annabelle <richanna=[email-masked] <mailto:richanna=[email-masked]>> wrote:
>> 
>> [email-masked] <mailto:[email-masked]>
> _______________________________________________
> Id-event mailing list
> [email-masked]