Subject: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs?

From: Christer Holmberg <[email-masked]>
Date: Tue, 23 Jan 2018 06:03:45 +0000

Hi,

Question for clarification:

Section 5.2.1 of draft-passport says:

       "There MUST be exactly one "orig" claim with exactly one identity claim object in a PASSporT object."

Q1: Does the text above mean that 

       a) a passport must always contain one, one only one, "orig" claim; or 
       b) that if a passport contains an "orig" claim, if can only contains one?

Q2: If a), does it apply to passport extensions too?

Q3: Does Q1/Q2 apply to "dest" too?

Regards,

Christer

---

From: Chris Wendt <[email-masked]>
Date: Tue, 23 Jan 2018 13:52:11 -0700

answers inline

> On Jan 22, 2018, at 11:03 PM, Christer Holmberg <[email-masked]> wrote:
> 
> Hi,
> 

It can only contain one key value pair with the key “orig” and the claim value can only be one identity.

In other words you cannot claim to originate multiple identities with a single passport object.

> Q2: If a), does it apply to passport extensions too?

All extensions must include the base passport claims and follow all rules of the claims, so yes.

> Q3: Does Q1/Q2 apply to "dest" too?

For “dest" the only difference is we allow an array of identities to accommodate future use of passport with multiple party calling or messaging where you send a call or message to multiple destination parties.

> 
> Regards,
> 
> Christer       
> 
> 
> 
> 
> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir

---

From: Christer Holmberg <[email-masked]>
Date: Tue, 23 Jan 2018 21:19:42 +0000

Hi Chris,

> In other words you cannot claim to originate multiple identities with a single passport object.

Correct. The question is whether "orig" is mandatory (alternative a) or not (alternative b). But, based on your reply to Q2 below, I assume the answer is alternative a).

I think it would be good to make that more clear. 

> All extensions must include the base passport claims and follow all rules of the claims, so yes.

I think it should be more clear whether a node can modify claims or not when adding an extension, or whether an extension needs to explicitly allow it. Currently the text only says (AFAIK) that claims cannot be removed.

For example, if I have a base passport, and add an RPH passport, I assume I cannot change the value of the "dest" claim. I would need to use a divert claim for that.

Also, as the passports may be added and signed by different authorities, and as each passport will contain the base claims, it means that the base claims will be signed multiple times, and they may be signed by different authorities. I assume that is ok.

Regards,

Christer

---

From: Chris Wendt <[email-masked]>
Date: Wed, 24 Jan 2018 06:44:39 -0700

Hi Christer,

I guess i’m not following what’s not clear, if you MUST only have one orig claim and one identity in that claim, that seems to be pretty clear to me that you cannot either not have an orig claim or have more than one.  I guess maybe i’m missing something subtle in your point.

For extensions, and in general with any PASSporT, once the PASSporT is signed, that’s it, you cannot modify claims or "re-sign".  If you want new PASSporT claim information that you want to sign, you must have a new PASSporT or new identity header.
Currently for divert, the approach is to embed a PASSporT inside a new PASSporT, which is a valid technique also and result in a new identity header also (but you should remove the old identity header in this case).

-Chris

> On Jan 23, 2018, at 2:19 PM, Christer Holmberg <[email-masked]> wrote:
> 
> Hi Chris,
>

---

From: Christer Holmberg <[email-masked]>
Date: Wed, 24 Jan 2018 14:05:33 +0000

Hi,

>I guess i¹m not following what¹s not clear, if you MUST only have one
>orig claim and one identity in that claim, that seems to be pretty clear
>to me that you cannot either not have an orig claim or have more than
>one.  I guess maybe i¹m missing something subtle in your point.

It is clear that you cannot have more than one claim, but I think it could
be made more clear that you always must have a claim to begin with :)

>For extensions, and in general with any PASSporT, once the PASSporT is
>signed, that¹s it, you cannot modify claims or "re-sign".  If you want
>new PASSporT claim information that you want to sign, you must have a new
>PASSporT or new identity header.

Correct, I should have made that clear.

So, if you have two (or more) Identity header fields, do they all have to
contain the same ³orig² value? Or, is one allowed to change it?

Does the same apply for ³dest²? And, if you want to change the ³dest² you
need to use the divert extension? You can¹t just add a new passport with a
new ³dest² value. Or?

>Currently for divert, the approach is to embed a PASSporT inside a new
>PASSporT, which is a valid technique also and result in a new identity
>header also (but you should remove the old identity header in this case).

My colleague Julio sent some questions and issues regarding the
³embedding²/³nesting² approach. I would be happy if you look at those :)

Regards,

Christer

>>>>      "There MUST be exactly one "orig" claim with exactly one
>>>>identity claim object in a PASSporT object."
>>>> 
>>> It can only contain one key value pair with the key ³orig² and the
>>>claim value can only be one identity.
>>> 
>> Correct. The question is whether "orig" is mandatory (alternative a) or
>>not (alternative b). But, based on your reply to Q2 below, I assume the
>>answer is alternative a).
>> 
>> I think it should be more clear whether a node can modify claims or not
>>when adding an extension, or whether an extension needs to explicitly
>>allow it. Currently the text only says (AFAIK) that claims cannot be
>>removed.
>> 
>> For example, if I have a base passport, and add an RPH passport, I
>>assume I cannot change the value of the "dest" claim. I would need to
>>use a divert claim for that.
>> 
>> Also, as the passports may be added and signed by different
>>authorities, and as each passport will contain the base claims, it means
>>that the base claims will be signed multiple times, and they may be
>>signed by different authorities. I assume that is ok.
>> 
>> Regards,
>> 
>> Christer
>> 
>

---

From: Julio Martinez-Minguito <[email-masked]>
Date: Fri, 26 Jan 2018 17:27:30 +0000

Hi,

I see in the nested divert that the new PASSporT has a claim "opt" which includes the PASSporT of the originating network, including the signature. 
The PASSporT added by the diverting network includes a claim "orig", which is copied from the 'original' PASSporT.
In this case , for a PASSporT ppt:div, the diverting network mays not have authority over the claim "orig", but only over the claim 'div'. A verifier will have to check the embedded PASSporT, verify the signature and check that the orig in the different PASSporT matches. 

Though in another cases, if the originating number and the diverting are served by the same operator, the operator has authority over both orig and div claims. A nested PASSporT would not be needed in this case. 

The end result is quite similar as if we have multiple Identity headers. In the end there are multiple PASSporT objects, the difference is how they are conveyed in the signaling. 

I assume the main reason for the embedding is because of the oob solution, or?

Regards, Julio

> -----Original Message-----
> From: Christer Holmberg [mailto:[email-masked]]
> Sent: den 24 januari 2018 15:06
> To: Chris Wendt <[email-masked]>
> Cc: [email-masked]
> Subject: Re: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs?
> 
> Hi,
> 
> >orig claim and one identity in that claim, that seems to be pretty
> >clear to me that you cannot either not have an orig claim or have more
> >than one.  I guess maybe i¹m missing something subtle in your point.
> 
> It is clear that you cannot have more than one claim, but I think it could be
> made more clear that you always must have a claim to begin with :)
> 
> >new PASSporT claim information that you want to sign, you must have a
> >new PASSporT or new identity header.
> 
> >> Correct. The question is whether "orig" is mandatory (alternative a)
> >>or not (alternative b). But, based on your reply to Q2 below, I assume
> >>the answer is alternative a).
> >>
> >> I think it should be more clear whether a node can modify claims or
> >>not when adding an extension, or whether an extension needs to
> >>explicitly allow it. Currently the text only says (AFAIK) that claims
> >>cannot be removed.
> >>
> >>authorities, and as each passport will contain the base claims, it
> >>means that the base claims will be signed multiple times, and they may
> >>be signed by different authorities. I assume that is ok.
> >>
> >> Regards,
> >>
> >> Christer
> >>
> >
>