Subject: Re: [stir] Second WGLC: draft-ietf-stir-passport-rcd-10

From: Chris Wendt <[email-masked]>
Date: Mon, 17 May 2021 11:19:50 -0400

Hi Russ,

Following up on this item. How about this proposed text for security consideration section for enhance-rfc8226:

There are potentially certain PASSporT claims that are defined to be claims that enhance security or integrity for another claim.  A specific example, “rcd” and “rcdi” are claims defined in [I.D.ietf-stir-passport-rcd] where “rcdi” first depends on the existence of the “rcd” claim and “rcdi” is only serving to qualify the integrity of the information in the “rcd”, not transmit any new information.  Therefore, there is likely little value for whether “rcdi” or claims with similar properties should be included as part of the mustExclude constraint and probably considered general best practice to not include those types of claims.

Let me know if this aligns with your concern and resolves it.

-Chris

> On Mar 19, 2021, at 11:45 AM, Russ Housley <[email-masked]> wrote:
> 
> Chris:
>> 
>> Thanks Russ for the review will take care of editorial/nits, discussion inline:
>> 
>>> On Mar 16, 2021, at 12:42 PM, Russ Housley <[email-masked]> wrote:
>>> 
>>> I have reviewed the document.  It is in good shape, but I have a few comments.
>>> 
>>> 
>>> TECHNICAL:
>>> 
>>> What happens if the JWTClaimConstraints in the certificate explicitly excludes the "rcdi" claim?
>> 
>> 
>> Good question, i think the easiest answer is I can’t think of a reason any authoritative certificate creator would want to do that, so question is whether we explicitly say MUST NOT do this normatively somewhere in the document?  I can do that, unless someone can come up with a scenario that excluding “rcdi” claim would be a good thing to do.  To me adding a unauthorized “rcdi” can only confirm the contents that is authorized or break the verification, so not sure there is any possibility of an attack if a “rcdi” is added by delegate signer if it’s not in mustInclude already.
> 
> I think a sentence or two in the Security Considerations of draft-ietf-stir-enhance-rfc8226 might be desirable.  It will need a reference to this document to be effective.  That is probably okay.
> 
> Russ
>

---

From: Russ Housley <[email-masked]>
Date: Mon, 17 May 2021 11:52:37 -0400

Chris:

I think we want to be stronger that "little value".  I think we want to tell certificate issuers that included int "rcdi" claim in the mustExclude list would prevent the relying party from validating the integrity of the rcd.

Russ

> On May 17, 2021, at 11:19 AM, Chris Wendt <[email-masked]> wrote:
> 
> Hi Russ,
> 
>> On Mar 19, 2021, at 11:45 AM, Russ Housley <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Chris:
>>> 
>>>> On Mar 16, 2021, at 12:42 PM, Russ Housley <[email-masked] <mailto:[email-masked]>> wrote:
>>>>

---

From: Chris Wendt <[email-masked]>
Date: Mon, 17 May 2021 20:24:05 -0400

Ok, sorry i guess i misread what you were saying and was confused at which security considerations in which document we were talking about.  I can definitely include something to address what happens if certificate owner mistakenly includes a mustExclude for “rcdi” in the cases it is required.  I think addressing the point below in RCD document is valid as well although i’ll make it specific to rcd/rcdi and i can include stronger words.  Will update in new version of rcd document.

-Chris

> On May 17, 2021, at 11:52 AM, Russ Housley <[email-masked]> wrote:
> 
> Chris:
> 
>> On May 17, 2021, at 11:19 AM, Chris Wendt <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Hi Russ,
>>