Subject: [stir] [Technical Errata Reported] RFC8224 (6519)

From: RFC Errata System <[email-masked]>
Date: Mon, 5 Apr 2021 22:20:47 -0700 (PDT)

The following errata report has been submitted for RFC8224,
"Authenticated Identity Management in the Session Initiation Protocol (SIP)".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6519

--------------------------------------
Type: Technical
Reported by: Roman Shpount <[email-masked]>

Section: 4

Original Text
-------------
ident-type = "ppt" EQUAL token

Corrected Text
--------------
ident-type = "ppt" EQUAL DQUOTE token DQUOTE

Notes
-----
Based on IETF 101 STIR notes ptr= values should always be quoted. Also, ATIS-1000074 is using double quotes around ppt value.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC8224 (draft-ietf-stir-rfc4474bis-16)
--------------------------------------
Title               : Authenticated Identity Management in the Session Initiation Protocol (SIP)
Publication Date    : February 2018
Author(s)           : J. Peterson, C. Jennings, E. Rescorla, C. Wendt
Category            : PROPOSED STANDARD
Source              : Secure Telephone Identity Revisited
Area                : Applications and Real-Time
Stream              : IETF
Verifying Party     : IESG

---

From: Cullen Jennings <[email-masked]>
Date: Tue, 6 Apr 2021 06:29:05 -0600

Roman, can you look at rfc8224 too, seem same issue is there 

> On Apr 5, 2021, at 11:20 PM, RFC Errata System <[email-masked]> wrote:
>

---

From: Cullen Jennings <[email-masked]>
Date: Tue, 6 Apr 2021 06:33:39 -0600

Roman, can you look at rfc8224 too, seems we have the same issue there

---

From: Roman Shpount <[email-masked]>
Date: Tue, 6 Apr 2021 10:57:03 -0400

I have reported this issue against RFC 8224. Did you want me to check
something else?

Roman Shpount

On Tue, Apr 6, 2021, 08:33 Cullen Jennings <[email-masked]> wrote:

> >> Based on IETF 101 STIR notes ptr= values should always be quoted. Also,
> ATIS-1000074 is using double quotes around ppt value.
> >>
> >> Instructions:
> >> -------------

---

From: Christer Holmberg <[email-masked]>
Date: Wed, 7 Apr 2021 15:23:05 +0000

Hi,

I have not been involved in the discussions, so my apologies for asking something that have been discussed already, but what is the reason for the change? If you anyway are only going to allow "token" characters, why the quotes? Is the only reason to align with how the parameter is used in other specs?

Regards,

Christer

-----Original Message-----
From: stir <[email-masked]> On Behalf Of RFC Errata System
Sent: tiistai 6. huhtikuuta 2021 8.21
To: [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]; Francesca Palombini <[email-masked]>; [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: [stir] [Technical Errata Reported] RFC8224 (6519)

The following errata report has been submitted for RFC8224, "Authenticated Identity Management in the Session Initiation Protocol (SIP)".

--------------------------------------
You may review the report below and at:
https://protect2.fireeye.com/v1/url?k=ac0542ba-f39e7bbf-ac050221-86959e472243-713aff0f88c18be4&q=1&e=6be2f688-f156-4c8b-953f-2bec6cf24d76&u=https%3A%2F%2Fwww.rfc-editor.org%2Ferrata%2Feid6519

Section: 4

Original Text
-------------

Corrected Text
--------------

Notes
-----

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. 

_______________________________________________
stir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/stir

---

From: Roman Shpount <[email-masked]>
Date: Wed, 7 Apr 2021 12:18:34 -0400

Hi Christer,

This is exactly the issue. ATIS documents and other RFCs like rfc8946 use
ppt with a quoted token.

Also, according to IETF 101 STIR notes (which you took), the ppt
token value should always be quoted. I am not sure why it needed to be
quoted (I think this is wrong), but that was the decision.
_____________
Roman Shpount

On Wed, Apr 7, 2021 at 11:23 AM Christer Holmberg <
[email-masked]> wrote:

> Hi,
>
> I have not been involved in the discussions, so my apologies for asking
> something that have been discussed already, but what is the reason for the
> change? If you anyway are only going to allow "token" characters, why the
> quotes? Is the only reason to align with how the parameter is used in other
> specs?
>
> Regards,
>
> Christer
>
>
> To: [email-masked]; [email-masked]; [email-masked];
> [email-masked]; [email-masked]; Francesca Palombini <
> [email-masked]>; [email-masked];
> [email-masked]
> The following errata report has been submitted for RFC8224, "Authenticated
> Identity Management in the Session Initiation Protocol (SIP)".
>
> This erratum is currently posted as "Reported". If necessary, please use
> "Reply All" to discuss whether it should be verified or rejected. When a
> decision is reached, the verifying party can log in to change the status
> and edit the report, if necessary.
>

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Wed, 7 Apr 2021 12:25:25 -0700

Hi Roman,

> This is exactly the issue. ATIS documents and other RFCs like rfc8946 use

Shouldn't the ABNF now be, to be compatible with non-SHAKEN implementations, this:

ident-type = "ppt" EQUAL (token / quoted-string)

-- 
Marc Petit-Huguenin
Email: [email-masked]
Blog: https://marc.petit-huguenin.org
Profile: https://www.linkedin.com/in/petithug

---

From: Christer Holmberg <[email-masked]>
Date: Wed, 7 Apr 2021 20:07:14 +0000

Ok, thanks for the memory refresh.

Regards,

Christer

-----Original Message-----
From: Marc Petit-Huguenin <[email-masked]> 
Sent: keskiviikko 7. huhtikuuta 2021 22.25
To: Roman Shpount <[email-masked]>; Christer Holmberg <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]; Francesca Palombini <[email-masked]>; RFC Errata System <[email-masked]>
Subject: Re: [stir] [Technical Errata Reported] RFC8224 (6519)

Hi Roman,

On 4/7/21 9:18 AM, Roman Shpount wrote:
> Hi Christer,
> 
> This is exactly the issue. ATIS documents and other RFCs like rfc8946 
> use ppt with a quoted token.

> 
> Also, according to IETF 101 STIR notes (which you took), the ppt token 
> value should always be quoted. I am not sure why it needed to be 
>> I have not been involved in the discussions, so my apologies for 
>> asking something that have been discussed already, but what is the 
>> reason for the change? If you anyway are only going to allow "token" 
>> characters, why the quotes? Is the only reason to align with how the 
>> parameter is used in other specs?
>>
>> Regards,
>>
>> Christer
>>
>>
>> https://protect2.fireeye.com/v1/url?k=ac0542ba-f39e7bbf-ac050221-8695
>> 9e472243-713aff0f88c18be4&q=1&e=6be2f688-f156-4c8b-953f-2bec6cf24d76&
>> u=https%3A%2F%2Fwww.rfc-editor.org%2Ferrata%2Feid6519
>>
>> use "Reply All" to discuss whether it should be verified or rejected. 
>> When a decision is reached, the verifying party can log in to change 
>> the status and edit the report, if necessary.
>>

--
Marc Petit-Huguenin
Email: [email-masked]
Blog: https://protect2.fireeye.com/v1/url?k=d873d4d4-87e8ed90-d873944f-861d41abace8-1ba57b7d439ca660&q=1&e=42151d84-9aa4-4d77-a4d9-6384ca516e8d&u=https%3A%2F%2Fmarc.petit-huguenin.org%2F
Profile: https://www.linkedin.com/in/petithug

---

From: Roman Shpount <[email-masked]>
Date: Wed, 7 Apr 2021 17:06:14 -0400

All the registered Personal Assertion Tokens are tokens:
https://www.iana.org/assignments/passport/passport.xhtml.

There is nothing in RFC8225 that limits the ppt header parameter's value,
so to be compatible, ident-type = "ppt" EQUAL (token / quoted-string) is
correct. This, however, does not reflect the decision to always put quotes
around the ppt value from IETF 101.

If this were up to me, I would say that the original ABNF is correct and
all the other documents and implementation which put quotes around the ppt
value are wrong. After all, these quotes serve no purpose except using
extra two bytes. Furthermore, there is no reason the use anything except
tokens to identify PASSporT Extensions.

I would also like to point out that the definition of info parameter is
also problematic since it is not a valid generic-param:
ident-info = "info" EQUAL ident-info-uri
ident-info-uri = LAQUOT absoluteURI RAQUOT

A quoted-string should have been used for the info, not the LAQUOT
absoluteURI RAQUOT.

I assume it is too late to fix either of these things.
_____________
Roman Shpount

On Wed, Apr 7, 2021 at 3:25 PM Marc Petit-Huguenin <[email-masked]>
wrote:

> "Authenticated

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Wed, 7 Apr 2021 14:17:55 -0700

> tokens to identify PASSporT Extensions.

I agree.

> A quoted-string should have been used for the info, not the LAQUOT

Good point.

There is also the issue that an Identity header should have supported the use of repetition using COMMA, now the we can have multiple Identity headers in a message.  Here we have to make it an exception, must like for the various authorization headers.

---

From: Roman Shpount <[email-masked]>
Date: Wed, 7 Apr 2021 17:51:51 -0400

If we were to fix things, I would suggest making the Date header optional
and putting "iat" in the Identity header instead. This, together with
putting attest and origid claims in Identity extension params, would allow
using compact digest and cutting a few hundred bytes out of the INVITE. As
things stand right now, all INVITE messages with shaken extension are over
the UDP MTU, causing major breakage in telephone networks as they are being
deployed.
_____________
Roman Shpount

On Wed, Apr 7, 2021 at 5:18 PM Marc Petit-Huguenin <[email-masked]>
wrote:

> There is also the issue that an Identity header should have supported the
> use of repetition using COMMA, now the we can have multiple Identity
> headers in a message.  Here we have to make it an exception, must like for
> the various authorization headers.
>
> >
> asking
> use

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Wed, 7 Apr 2021 15:03:03 -0700

On the subject of origid, we could have used the local part of a Session-ID instead (RFC 7989), which would have been far more useful, IMO.

---

From: Roman Shpount <[email-masked]>
Date: Wed, 7 Apr 2021 18:33:21 -0400

On Wed, Apr 7, 2021 at 6:03 PM Marc Petit-Huguenin <[email-masked]>
wrote:

> On the subject of origid, we could have used the local part of a
> Session-ID instead (RFC 7989), which would have been far more useful, IMO.
>
>
Agreed
_____________
Roman Shpount