Subject: Re: [stir] draft-housley-stir-enhance-rfc8226-00

From: Jack Rickard <[email-masked]>
Date: Tue, 2 Feb 2021 11:10:33 +0000

This looks fine from my point of view, however, what is the actual motivation behind this? I'd like to know why these extra constraint options need to be added before supporting it.

Thanks,
Jack

From: stir <[email-masked]> On Behalf Of Russ Housley
Sent: 21 January 2021 21:32
To: IETF STIR Mail List <[email-masked]>
Subject: [stir] draft-housley-stir-enhance-rfc8226-00

NOTE: Message is from an external sender
Please review and comment.  Christ Wendt has found some use cases where the JWT Claims Constraints in RFC 8226 are not adequate.  This I-D proposes an enhancement to make the constraints more rich.

Russ

From: [email-masked]<mailto:[email-masked]>
Subject: New Version Notification for draft-housley-stir-enhance-rfc8226-00.txt
Date: January 21, 2021 at 4:29:14 PM EST
To: "Russ Housley" <[email-masked]<mailto:[email-masked]>>

A new version of I-D, draft-housley-stir-enhance-rfc8226-00.txt
has been successfully submitted by Russ Housley and posted to the
IETF repository.

Name: draft-housley-stir-enhance-rfc8226
Revision: 00
Title: Enhanced JWT Claim Constraints for STIR Certificates
Document date: 2021-01-21
Group: Individual Submission
Pages: 8
URL:            https://www.ietf.org/archive/id/draft-housley-stir-enhance-rfc8226-00.txt<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Farchive%2Fid%2Fdraft-housley-stir-enhance-rfc8226-00.txt&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663231466%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Up1Zpc7Zdsels%2BIi4BDYQaOQBMHKdNvgIR4eYWkTuSE%3D&reserved=0>
Status:         https://datatracker.ietf.org/doc/draft-housley-stir-enhance-rfc8226/<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-housley-stir-enhance-rfc8226%2F&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663241455%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=W7ymLZVcTnd%2FghnUexmB4P1x1KezM8I%2BdYGANBW0u0M%3D&reserved=0>
Htmlized:       https://datatracker.ietf.org/doc/html/draft-housley-stir-enhance-rfc8226<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-housley-stir-enhance-rfc8226&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663241455%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=zxAv5QKkbF3PsWFCEe5DLtNWORCv2Cs32t4heAFEWds%3D&reserved=0>
Htmlized:       https://tools.ietf.org/html/draft-housley-stir-enhance-rfc8226-00<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-housley-stir-enhance-rfc8226-00&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663251451%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Pw7YnTkYETyXDYUEBarZ1zkBkP8fGPfG4uj3cp%2BRcfM%3D&reserved=0>

Abstract:
  RFC 8226 provides a certificate extension to constrain the JWT claims
  that can be included in the PASSporT as defined in RFC 8225.  If the
  signer includes a JWT claim outside the constraint boundaries, then
  the recipient will reject the entire PASSporT.  This document defines
  additional ways that the JWT claims can be constrained.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org<https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftools.ietf.org%2F&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663251451%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Pfo8cYuP9pvWiy4AuNGEnXjsCLuqd5OrC%2FIw4UL0Sw4%3D&reserved=0>.

The IETF Secretariat

---

From: Chris Wendt <[email-masked]>
Date: Tue, 2 Feb 2021 11:02:40 -0500

Hi Jack,

We want to make sure we can easily constrain the ability for someone to add claims they are not allowed to and make them look legit, in particular this becomes more relevant with delegation (or at least this is where we hit these requirements while going through the use-cases).  So rather than just constrain the fact that you must have a particular claim, constrain the fact that they shouldn’t be there. There is techniques we discussed working with current mechanisms in 8226, but we thought it might be more clear and explicit to have these new constraints.

-Chris

> On Feb 2, 2021, at 6:10 AM, Jack Rickard <Jack.Rickard=[email-masked]> wrote:
> 
> From: stir <[email-masked] <mailto:[email-masked]>> On Behalf Of Russ Housley
> To: IETF STIR Mail List <[email-masked] <mailto:[email-masked]>>
> From: [email-masked] <mailto:[email-masked]>
> To: "Russ Housley" <[email-masked] <mailto:[email-masked]>>
>  
> 
> URL:            https://www.ietf.org/archive/id/draft-housley-stir-enhance-rfc8226-00.txt <https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Farchive%2Fid%2Fdraft-housley-stir-enhance-rfc8226-00.txt&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663231466%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Up1Zpc7Zdsels%2BIi4BDYQaOQBMHKdNvgIR4eYWkTuSE%3D&reserved=0>
> Status:         https://datatracker.ietf.org/doc/draft-housley-stir-enhance-rfc8226/ <https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-housley-stir-enhance-rfc8226%2F&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663241455%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=W7ymLZVcTnd%2FghnUexmB4P1x1KezM8I%2BdYGANBW0u0M%3D&reserved=0>
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-housley-stir-enhance-rfc8226 <https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-housley-stir-enhance-rfc8226&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663241455%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=zxAv5QKkbF3PsWFCEe5DLtNWORCv2Cs32t4heAFEWds%3D&reserved=0>
> Htmlized:       https://tools.ietf.org/html/draft-housley-stir-enhance-rfc8226-00 <https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-housley-stir-enhance-rfc8226-00&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663251451%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Pw7YnTkYETyXDYUEBarZ1zkBkP8fGPfG4uj3cp%2BRcfM%3D&reserved=0>
> 
> 
> Abstract:
> until the htmlized version and diff are available at tools.ietf.org <https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftools.ietf.org%2F&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C41eae97dc9d843ee0dc208d8be5415db%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637468615663251451%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Pfo8cYuP9pvWiy4AuNGEnXjsCLuqd5OrC%2FIw4UL0Sw4%3D&reserved=0>.
> 
> The IETF Secretariat
> 
> 
>  
> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir

---

From: Jack Rickard <[email-masked]>
Date: Thu, 4 Feb 2021 16:21:04 +0000

Thank you, that's really useful information.

Jack

From: stir <[email-masked]> On Behalf Of Chris Wendt
Sent: 02 February 2021 16:03
To: Jack Rickard <Jack.Rickard=[email-masked]>
Cc: IETF STIR Mail List <[email-masked]>; Russ Housley <[email-masked]>
Subject: Re: [stir] draft-housley-stir-enhance-rfc8226-00

We want to make sure we can easily constrain the ability for someone to add claims they are not allowed to and make them look legit, in particular this becomes more relevant with delegation (or at least this is where we hit these requirements while going through the use-cases).  So rather than just constrain the fact that you must have a particular claim, constrain the fact that they shouldn't be there. There is techniques we discussed working with current mechanisms in 8226, but we thought it might be more clear and explicit to have these new constraints.

-Chris

On Feb 2, 2021, at 6:10 AM, Jack Rickard <Jack.Rickard=[email-masked]<mailto:Jack.Rickard=[email-masked]>> wrote:

Thanks,
Jack

From: stir <[email-masked]<mailto:[email-masked]>> On Behalf Of Russ Housley
Sent: 21 January 2021 21:32
To: IETF STIR Mail List <[email-masked]<mailto:[email-masked]>>
Subject: [stir] draft-housley-stir-enhance-rfc8226-00

Russ

Name: draft-housley-stir-enhance-rfc8226
Revision: 00
Title: Enhanced JWT Claim Constraints for STIR Certificates
Document date: 2021-01-21
Group: Individual Submission
Pages: 8
URL:            https://www.ietf.org/archive/id/draft-housley-stir-enhance-rfc8226-00.txt<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Farchive%2Fid%2Fdraft-housley-stir-enhance-rfc8226-00.txt&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C9d522cd2662447c3112608d8c794000c%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637478785757165929%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=MCqf3m%2FXJKntDm3L9ycii13nJGcVp7Sur%2BGbWI5%2FGgU%3D&reserved=0>
Status:         https://datatracker.ietf.org/doc/draft-housley-stir-enhance-rfc8226/<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-housley-stir-enhance-rfc8226%2F&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C9d522cd2662447c3112608d8c794000c%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637478785757165929%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=6DHwyOSvkH96NbBkoVF2LHwpRWDE1s7Y0COAl8zXBrg%3D&reserved=0>
Htmlized:       https://datatracker.ietf.org/doc/html/draft-housley-stir-enhance-rfc8226<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-housley-stir-enhance-rfc8226&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C9d522cd2662447c3112608d8c794000c%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637478785757175923%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ix9dMxycNkm%2FJXikJ%2FOW5uGBFziKTMv%2Bt3NsMBnSpWs%3D&reserved=0>
Htmlized:       https://tools.ietf.org/html/draft-housley-stir-enhance-rfc8226-00<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-housley-stir-enhance-rfc8226-00&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C9d522cd2662447c3112608d8c794000c%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637478785757185916%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=CFOQvZLtetRWJ9ME98GENm%2BLKRgO4ulEeU4vz4iYLjU%3D&reserved=0>

Abstract:

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org<https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftools.ietf.org%2F&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C9d522cd2662447c3112608d8c794000c%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637478785757185916%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=rqc%2ByDpC3XnkF415v1%2FWsNw67MvVbY7oPcSHBPCdvJE%3D&reserved=0>.

The IETF Secretariat

_______________________________________________
stir mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/stir<https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fstir&data=04%7C01%7Cjack.rickard%40metaswitch.com%7C9d522cd2662447c3112608d8c794000c%7C9d9e56ebf6134ddbb27bbfcdf14b2cdb%7C1%7C0%7C637478785757195914%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=4YcCBQDJqeYaGIcsn9DrJyOJZTBJ1apdB491N%2FYOUL8%3D&reserved=0>

---

From: Sean Turner <[email-masked]>
Date: Thu, 4 Feb 2021 15:26:50 -0500

I knew we should have added this at the time ;) Let’s do it.

spt

> On Jan 21, 2021, at 16:32, Russ Housley <[email-masked]> wrote:
> 
>> From: [email-masked]
>> To: "Russ Housley" <[email-masked]>
>> 
>> 
>> URL:            https://www.ietf.org/archive/id/draft-housley-stir-enhance-rfc8226-00.txt
>> Status:         https://datatracker.ietf.org/doc/draft-housley-stir-enhance-rfc8226/
>> Htmlized:       https://datatracker.ietf.org/doc/html/draft-housley-stir-enhance-rfc8226
>> Htmlized:       https://tools.ietf.org/html/draft-housley-stir-enhance-rfc8226-00
>> 
>> 
>> Abstract:
>> until the htmlized version and diff are available at tools.ietf.org.
>> 
>> The IETF Secretariat
>> 
>> 
>