Subject: [stir] wglc comment: draft-ietf-stir-passport-divert-05

From: Robert Sparks <[email-masked]>
Date: Fri, 12 Apr 2019 15:45:39 -0500

This is a bit of an edge condition thing.

Section 4.2 talks about normal verification, and states (maybe implies) 
that there will only be one outermost PASSport in a chain of "div"s.

What if there are two (from someone trying to be malicious)?

RjS

---

From: "Peterson, Jon" <[email-masked]>
Date: Mon, 15 Apr 2019 19:00:41 +0000

Well, I’d treat that as a case where there are effectively two chains in the request, each ending with an outermost "div" (as the last sentence of the first paragraph of 4.2 states). If the outermost "div" in one of those chains is malicious, which is to say its signature or attestation doesn't check out, that chain is treated as invalid. The key point is that each chain has an outermost "div", at least with the rough definition of "chain" that I'm trying to use here. If there's a useful way for me to clarify the intention, happy to do it.

Jon Peterson
Neustar, Inc.

On 4/12/19, 1:45 PM, "stir on behalf of Robert Sparks" <[email-masked] on behalf of [email-masked]> wrote:

    
    
    RjS
    
    _______________________________________________
    stir mailing list
    [email-masked]
    https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_stir&d=DwICAg&c=MOptNlVtIETeDALC_lULrw&r=dQ51tLfoGuuFjanmfeKC0weXHNMl9xZnnsIiwRd6IgY&m=JKplr8xRHUpP2VMY3J4NzGLWPjruHaLKAAuv2XwT9d0&s=Wu6Jh31lewMk0RBcsI56rUNDVPBAneE4Mfl3DKGMab4&e=