Subject: Re: [Jwt-reg-review] Review requested: draft-ietf-sipcore-rejected

From: Brian Campbell <[email-masked]>
Date: Tue, 11 Jun 2019 09:30:21 -0600

Looking again at this and the more recent revision of the draft, I do think
the jcard claim registration is okay in general.

However, the IANA Considerations registration request at
https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-5.3
points to
https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-3.2.2,
which I think could do a little better job of describing what the value of
the jcard claim will be - particularly for folks like myself who are
unfamiliar with jCard. The link back to section-5.3 is just circular and
isn't particularly helpful. So I went looking to the examples to see a
jcard claim to help me understand and I noticed the JWS header in
https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-4.1
isn't valid JOSE/JWS, which should probably be fixed. The 'alg', 'typ', and
'x5u' header parameters should all be top level members of the JSON rather
than wrapped in extra {}'s. See
https://tools.ietf.org/html/rfc7515#appendix-A.1.1 for example.

On Sat, Mar 2, 2019 at 6:48 AM Brian Campbell <[email-masked]>
wrote:

> also approve
>
> On Sat, Mar 2, 2019 at 5:44 AM Mike Jones <Michael.Jones=
> [email-masked]> wrote:
>
>> In my role as a Designated Expert, I approve this registration request.
>>
>>                                 -- Mike
>>
>> -----Original Message-----
>> From: Jwt-reg-review <[email-masked]> On Behalf Of A.
>> Jean Mahoney
>> Sent: Thursday, February 28, 2019 2:11 PM
>> To: [email-masked]
>> Cc: [email-masked]; [email-masked]
>> Subject: [Jwt-reg-review] Review requested: draft-ietf-sipcore-rejected
>>
>> Hi JWT Registration Review Team,
>>
>> Please review the JWT claim registration request found in Section 5.3 of
>> draft-ietf-sipcore-rejected [1]. The draft has just finished WGLC.
>>
>> Thanks!
>>
>> Jean, as Doc Shepherd
>>
>> [1]
>> https://tools.ietf.org/html/draft-ietf-sipcore-rejected-03#section-5.3
>>
>> ------------------
>>
>>  From the draft:
>>
>>
>> 5.3.  JSON Web Token Claim
>>
>>     This document defines the new JSON Web Token claim in the "JSON Web
>>     Token Claims" sub-registry created by [RFC7519].  Section 3.2.2
>>     defines the syntax.  The required information is:
>>
>>     Claim Name:  jcard
>>
>>     Claim Description:  jCard data
>>
>>     Change Controller:  IESG
>>
>>     Reference:  [RFCXXXX], [RFC7095]
>>
>> _______________________________________________
>> Jwt-reg-review mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/jwt-reg-review
>>
>> _______________________________________________
>> Jwt-reg-review mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/jwt-reg-review
>>
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

---

From: Eric Burger <[email-masked]>
Date: Tue, 11 Jun 2019 22:21:37 -0400

Thanks! We knew the JWS wasn’t quite right, which we were going to fix once we got this round of comments.

The reason for putting the jCard into a JWS is we (external to the IETF) have a mechanism of using the root CA of a signing certificate to ensure the integrity and identity of the entity signing the jCard. For example, one could have a policy that only an entity with the X.509 Subject of the jCard ‘Name’ can sign the jCard. Anyone else signing the card means the card is not valid. We don’t go into too many details as that sort of decision making could be seen as outside the scope of the IETF.

> On Jun 11, 2019, at 11:30 AM, Brian Campbell <[email-masked]> wrote:
> 
> Looking again at this and the more recent revision of the draft, I do think the jcard claim registration is okay in general.
> 
> However, the IANA Considerations registration request at https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-5.3 <https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-5.3> points to https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-3.2.2 <https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-3.2.2>, which I think could do a little better job of describing what the value of the jcard claim will be - particularly for folks like myself who are unfamiliar with jCard. The link back to section-5.3 is just circular and isn't particularly helpful. So I went looking to the examples to see a jcard claim to help me understand and I noticed the JWS header in https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-4.1 <https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-4.1> isn't valid JOSE/JWS, which should probably be fixed. The 'alg', 'typ', and 'x5u' header parameters should all be top level members of the JSON rather than wrapped in extra {}'s. See https://tools.ietf.org/html/rfc7515#appendix-A.1.1 <https://tools.ietf.org/html/rfc7515#appendix-A.1.1> for example.
> 
> On Sat, Mar 2, 2019 at 6:48 AM Brian Campbell <[email-masked] <mailto:[email-masked]>> wrote:
> also approve
> 
> On Sat, Mar 2, 2019 at 5:44 AM Mike Jones <Michael.Jones=[email-masked] <mailto:[email-masked]>> wrote:
> From: Jwt-reg-review <[email-masked] <mailto:[email-masked]>> On Behalf Of A. Jean Mahoney
> To: [email-masked] <mailto:[email-masked]>
> Cc: [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
> Please review the JWT claim registration request found in Section 5.3 of draft-ietf-sipcore-rejected [1]. The draft has just finished WGLC.
> 
> Thanks!
> 
> Jean, as Doc Shepherd
> 
> [1] https://tools.ietf.org/html/draft-ietf-sipcore-rejected-03#section-5.3 <https://tools.ietf.org/html/draft-ietf-sipcore-rejected-03#section-5.3>
> 
> ------------------
> 
>  From the draft:
> 
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/jwt-reg-review <https://www.ietf.org/mailman/listinfo/jwt-reg-review>
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/jwt-reg-review <https://www.ietf.org/mailman/listinfo/jwt-reg-review>
> 
> CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited.  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.

---

From: Eric Burger <[email-masked]>
Date: Wed, 19 Jun 2019 21:45:51 -0400

Would having a reference to jCard suffice, or do we need a detailed explanation of what a jCard is?

---

From: Brian Campbell <[email-masked]>
Date: Thu, 20 Jun 2019 15:53:47 -0600

I think a reference is good. I was looking for or expecting just a brief
statement in sec 3.3 along the lines of 'the value of the "jcard" claim is
a JSON array conforming to the JSON jCard data format defined in RFC7095'
or something like that.

On Wed, Jun 19, 2019 at 7:45 PM Eric Burger <[email-masked]>
wrote:

> Looking again at this and the more recent revision of the draft, I do
> think the jcard claim registration is okay in general.
>
> *CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly prohibited.
> If you have received this communication in error, please notify the sender
> immediately by e-mail and delete the message and any file attachments from
> your computer. Thank you.*
>
>
>

---

From: Mike Jones <[email-masked]>
Date: Fri, 21 Jun 2019 07:25:15 +0000

+1

From: Brian Campbell <bcampbell=[email-masked]>
Sent: Thursday, June 20, 2019 2:54 PM
To: Eric Burger <[email-masked]>
Cc: Mike Jones <[email-masked]>; [email-masked]; [email-masked]
Subject: Re: [Jwt-reg-review] Review requested: draft-ietf-sipcore-rejected

I think a reference is good. I was looking for or expecting just a brief statement in sec 3.3 along the lines of 'the value of the "jcard" claim is a JSON array conforming to the JSON jCard data format defined in RFC7095' or something like that.

On Wed, Jun 19, 2019 at 7:45 PM Eric Burger <[email-masked]<mailto:eburger@standardstrack..com>> wrote:
Would having a reference to jCard suffice, or do we need a detailed explanation of what a jCard is?

On Jun 11, 2019, at 11:30 AM, Brian Campbell <[email-masked]<mailto:[email-masked]>> wrote:

However, the IANA Considerations registration request at https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-5.3<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-sipcore-rejected-08%23section-5.3&data=02%7C01%7CMichael.Jones%40microsoft.com%7C56475904f05d4e95c46808d6f5c9da8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636966644634466340&sdata=6EuttKU84uyginhv4s7zezlyVKIZwnQssc5lXrvi3pc%3D&reserved=0> points to https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-3.2.2<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-sipcore-rejected-08%23section-3.2.2&data=02%7C01%7CMichael.Jones%40microsoft.com%7C56475904f05d4e95c46808d6f5c9da8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636966644634476335&sdata=zY4w%2BMYxUvLhx0UxOFcpystg8DbLem71%2BGq5aGeO34Q%3D&reserved=0>, which I think could do a little better job of describing what the value of the jcard claim will be - particularly for folks like myself who are unfamiliar with jCard. The link back to section-5.3 is just circular and isn't particularly helpful. So I went looking to the examples to see a jcard claim to help me understand and I noticed the JWS header in https://tools.ietf.org/html/draft-ietf-sipcore-rejected-08#section-4.1<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-sipcore-rejected-08%23section-4.1&data=02%7C01%7CMichael.Jones%40microsoft.com%7C56475904f05d4e95c46808d6f5c9da8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636966644634476335&sdata=Sm9ph0Ul01v%2FQ175%2BAL66nBpxJ0A3EcjPYLRfiySzKs%3D&reserved=0> isn't valid JOSE/JWS, which should probably be fixed. The 'alg', 'typ', and 'x5u' header parameters should all be top level members of the JSON rather than wrapped in extra {}'s. See https://tools.ietf.org/html/rfc7515#appendix-A.1.1<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Frfc7515%23appendix-A.1.1&data=02%7C01%7CMichael.Jones%40microsoft.com%7C56475904f05d4e95c46808d6f5c9da8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636966644634486334&sdata=rkxS6tOndNCI8Kc%2FMUkRWnVQYg2WhjzZDiWLvvy7CiY%3D&reserved=0> for example.

On Sat, Mar 2, 2019 at 6:48 AM Brian Campbell <[email-masked]<mailto:[email-masked]>> wrote:
also approve

On Sat, Mar 2, 2019 at 5:44 AM Mike Jones <Michael.Jones=[email-masked]<mailto:[email-masked]>> wrote:
In my role as a Designated Expert, I approve this registration request.

                                -- Mike

-----Original Message-----
From: Jwt-reg-review <[email-masked]<mailto:[email-masked]>> On Behalf Of A. Jean Mahoney
Sent: Thursday, February 28, 2019 2:11 PM
To: [email-masked]<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: [Jwt-reg-review] Review requested: draft-ietf-sipcore-rejected

Thanks!

Jean, as Doc Shepherd

[1] https://tools.ietf.org/html/draft-ietf-sipcore-rejected-03#section-5.3<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-sipcore-rejected-03%23section-5.3&data=02%7C01%7CMichael.Jones%40microsoft.com%7C56475904f05d4e95c46808d6f5c9da8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636966644634496326&sdata=cDSLiKWWqDyxdFaSU%2Fp3mB3uOWYYeQsvrKrtAXI6dzw%3D&reserved=0>

------------------

 From the draft:

    Claim Name:  jcard

    Change Controller:  IESG

_______________________________________________
Jwt-reg-review mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jwt-reg-review<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fjwt-reg-review&data=02%7C01%7CMichael.Jones%40microsoft.com%7C56475904f05d4e95c46808d6f5c9da8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636966644634496326&sdata=v78QgrzLM8aorZwFar6itcZqxzqGLekzxqlhrVr4O1g%3D&reserved=0>

_______________________________________________
Jwt-reg-review mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jwt-reg-review<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fjwt-reg-review&data=02%7C01%7CMichael.Jones%40microsoft.com%7C56475904f05d4e95c46808d6f5c9da8b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636966644634506327&sdata=1X6E91FIj7iiN31z1f4VEB10erdeM3sCyTyuTOwkGTA%3D&reserved=0>

CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited..  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.