Subject: [stir] Erik Kline's No Objection on draft-ietf-stir-enhance-rfc8226-03: (with COMMENT)

From: Erik Kline via Datatracker <[email-masked]>
Date: Sat, 26 Jun 2021 15:53:34 -0700

Erik Kline has entered the following ballot position for
draft-ietf-stir-enhance-rfc8226-03: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-stir-enhance-rfc8226/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

[S4] [comment]

* Given the example in section 5, it seems that mustInclude can be used
  in conjunction with permittedValues.

  Perhaps amend the last sentence of the 2nd example to indicate this?

  "However, a verification service will not treat as invalid a PASSporT
  it receives without a PASSporT "confidence" claim at all (unless also
  appearing in a mustInclude claim)."

  or something...

---

From: Russ Housley <[email-masked]>
Date: Sun, 27 Jun 2021 13:07:02 -0400

Sure, we can be more explicit about that case.  How about:

   *  If a CA issues a certificate to an authentication service that
      includes an Enhanced JWT Claim Constraints certificate extension
      that contains the permittedValues JWTClaimName "confidence" and a
      permitted "high" value, then a verification service will treat as
      invalid any PASSporT it receives with a PASSporT "confidence"
      claim with a value other than "high".  However, a verification
      service will not treat as invalid a PASSporT it receives without a
      PASSporT "confidence" claim at all, unless "confidence" also
      appears in mustInclude.

Russ

---

From: Erik Kline <[email-masked]>
Date: Sun, 27 Jun 2021 11:03:58 -0700

>       PASSporT "confidence" claim at all, unless "confidence" also

Sounds perfect; thanks!