Subject: [stir] Clarification about usage of multiple PASSporT extensions

From: Julio Martinez-Minguito <[email-masked]>
Date: Mon, 6 Nov 2017 08:26:32 +0000

Hi,

There are now defined multiple extensions for the PASSporT object, e.g.  "shaken", "cdiv", "rph"...
These are not exclusive, multiple could be used for the same PASSporT object.
How can multiple extensions be indicated? The definition of the "ppt" parameter in the draft is not explicit about how to use it, it just has an example
The draft says:

"... If it is necessary for an extension to PASSporT to require that a relying party support a particular extended claim or set of claims in the PASSporT object, it can do so by specifying a "ppt" element for the PASSporT JOSE header"

8.2<https://tools.ietf.org/html/draft-ietf-stir-passport-11#section-8.2>.  Example extended PASSporT header

   An example header with a PASSporT extension type of "foo" is as

   follows:

   {

     "alg":"ES256",

     "ppt":"foo",

     "typ":"passport",

     "x5u":"https://tel.example.org/passport.cer"

   }

Is it implicit that "ppt" can be a list? Maybe it's defined so in the JWT or JWS specifications... or should there be multiple entries of "ppt"?
e.g.
"ppt":"shaken","rph"     or
"ppt":["shaken","rph"]     or
{...
"ppt":"shaken"
"ppt":"rph"
...}

It would be good to clarify in the PASSporT specification how to use multiple extensions.

Regards  Julio

---

From: Chris Wendt <[email-masked]>
Date: Mon, 6 Nov 2017 15:45:04 -0500

These passport extensions should be used one per passport and for example in SIP/4474bis would correspond to different identity headers.
I think this keeps separation of concerns.  We are currently discussing usage of call diversion in shaken and if there is a need for a combination of extensions, we will likely create a new extension with specific guidance on it’s usage.
However, for shaken and call diversion identity headers, to continue with the example, are applied at different points in the call flow, so it may be a moot point and require different identity headers in either case.  But like i said more analysis and work is required.  I believe the call diversion draft isn’t finalized either so that probably needs to settle down a bit before we finalize anything in regards to extension usage.

> On Nov 6, 2017, at 3:26 AM, Julio Martinez-Minguito <[email-masked]> wrote:
> 
> Hi,
>  
> There are now defined multiple extensions for the PASSporT object, e.g.  “shaken”, “cdiv”, “rph”…
> How can multiple extensions be indicated? The definition of the “ppt” parameter in the draft is not explicit about how to use it, it just has an example
> The draft says:
>  
> “… If it is necessary for an extension to PASSporT to require that a relying party support a particular extended claim or set of claims in the PASSporT object, it can do so by specifying a "ppt" element for the PASSporT JOSE header”
>  <>8.2 <https://tools.ietf.org/html/draft-ietf-stir-passport-11#section-8.2>.  Example extended PASSporT header
> 
>      "x5u":"https://tel.example.org/passport.cer <https://tel.example.org/passport.cer>"
>    }
>  
> Is it implicit that “ppt” can be a list? Maybe it’s defined so in the JWT or JWS specifications… or should there be multiple entries of “ppt”?
> e.g. 
> “ppt”:”shaken”,”rph”     or 
> “ppt”:[“shaken”,”rph”]     or
> {…
> “ppt”:”shaken”
> “ppt”:”rph”
> …}
>  
> _______________________________________________
> stir mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/stir <https://www.ietf.org/mailman/listinfo/stir>