Subject: [stir] draft-ietf-stir-passport-rcd-14 Claim Constraints permittedValues for rcdi

From: Simon Castle <[email-masked]>
Date: Fri, 18 Feb 2022 11:18:38 +0000

Hi all,

I'm concerned that there is a bug in the expected interactions of RCD claims and the expected use of JWT Claim Constraints.

  *   According to draft-ietf-stir-passport-rcd-14 Section 7 'JWT Claim Constraints usage for "rcd" and "rcdi" claims', the expected use case is for signing certificates to specify a "permittedValues" entry for the "rcdi" claim value string.
  *   According to RFC 8226 Section 8 'JWT Claim Constraints Syntax', these permitted values are defined as a sequence of UTF8String.
  *   However, the "rcdi" claim value isn't a string: it's a JSON object, as defined in draft-ietf-stir-passport-rcd-14 Section 6 '"rcdi" RCD Integrity Claim Definition and Usage.

Is the expectation that the permittedValues contains a UTF-8 String representation of a JSON Object?  Or should the Claim Constraints be made on the individual sub-fields of the rcdi claim (e.g. "/jcd", "/jcd/1/3/3") instead of the top level rcdi claim?

Thanks,
Simon Castle
he/him
Software Engineer
[email-masked]<mailto:[email-masked]>

[Microsoft Logo]

---

From: Alec Fenichel <[email-masked]>
Date: Fri, 18 Feb 2022 18:34:55 +0000

My interpretation was that permittedValues contains the JSON string representation of the rcdi object (i.e., “JSON.stringify(passport.payload.rcdi)”). I’m not saying we should or should not do it this way, just that that was my interpretation of the current text.

Sincerely,

Alec Fenichel

Chief Technology Officer

TransNexus

[email-masked]

+1 (404) 369-2407

From: stir <[email-masked]> on behalf of Simon Castle <simoncastle=[email-masked]>
Date: Friday, February 18, 2022 at 06:19
To: [email-masked] <[email-masked]>
Subject: [stir] draft-ietf-stir-passport-rcd-14 Claim Constraints permittedValues for rcdi

You don't often get email from simoncastle=[email-masked]. Learn why this is important

Hi all,

I’m concerned that there is a bug in the expected interactions of RCD claims and the expected use of JWT Claim Constraints.

According to draft-ietf-stir-passport-rcd-14 Section 7 ‘JWT Claim Constraints usage for “rcd” and “rcdi” claims’, the expected use case is for signing certificates to specify a “permittedValues” entry for the “rcdi” claim value string.

According to RFC 8226 Section 8 ‘JWT Claim Constraints Syntax’, these permitted values are defined as a sequence of UTF8String.

However, the “rcdi” claim value isn’t a string: it’s a JSON object, as defined in draft-ietf-stir-passport-rcd-14 Section 6 ‘”rcdi” RCD Integrity Claim Definition and Usage.

Is the expectation that the permittedValues contains a UTF-8 String representation of a JSON Object?  Or should the Claim Constraints be made on the individual sub-fields of the rcdi claim (e.g. “/jcd”, “/jcd/1/3/3”) instead of the top level rcdi claim?

Thanks,

Simon Castle
he/him
Software Engineer
[email-masked]

---

From: Russ Housley <[email-masked]>
Date: Fri, 18 Feb 2022 14:02:56 -0500

Yes, that is my understanding as well.

> On Feb 18, 2022, at 1:34 PM, Alec Fenichel <alec.fenichel=[email-masked]> wrote:
> 
> TransNexus <https://transnexus.com/>
> [email-masked] <mailto:[email-masked]>
> +1 (404) 369-2407 <tel:+14043692407>
> 
> From: stir <[email-masked] <mailto:[email-masked]>> on behalf of Simon Castle <simoncastle=[email-masked] <mailto:simoncastle=[email-masked]>>
> To: [email-masked] <mailto:[email-masked]> <[email-masked] <mailto:[email-masked]>>
> You don't often get email from simoncastle=[email-masked] <mailto:simoncastle=[email-masked]>. Learn why this is important <http://aka.ms/LearnAboutSenderIdentification>
> Hi all,
> 
> [email-masked] <mailto:[email-masked]>
> 
> <image001[45].png>
> 
> _______________________________________________
> stir mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/stir <https://www.ietf.org/mailman/listinfo/stir>

---

From: Chris Wendt <[email-masked]>
Date: Sat, 19 Feb 2022 15:28:32 -0500

Mine as well, i can clarify this in the text of 15 to make this clearer.  Thanks for bringing that issue up.

-Chris

> On Feb 18, 2022, at 2:02 PM, Russ Housley <[email-masked]> wrote:
> 
>> On Feb 18, 2022, at 1:34 PM, Alec Fenichel <alec.fenichel=[email-masked] <mailto:alec.fenichel=[email-masked]>> wrote:
>> 
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir