Subject: [stir] Publication has been requested for draft-ietf-stir-enhance-rfc8226-02

From: Robert Sparks via Datatracker <[email-masked]>
Date: Tue, 25 May 2021 13:10:24 -0700

Robert Sparks has requested publication of draft-ietf-stir-enhance-rfc8226-02 as Proposed Standard on behalf of the STIR working group.

Please verify the document's state at https://datatracker.ietf.org/doc/draft-ietf-stir-enhance-rfc8226/

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 27 May 2021 09:11:59 -0700

A brief AD review; I'm going to Last Call this now as my feedback is minor,
so please just factor this in as Last Call feedback:

In Section 3 (and later), stuff like mustInclude and permittedValues aren't
quoted, but smaller things like "iat", "orig", and "dest" are.  More
generally I found the use or non-use of quotes felt inconsistent.  I don't
have a preferred solution, just something to consider.  I don't know what,
if anything, the RFC Editor might do if they observe the same.

-MSK

On Tue, May 25, 2021 at 1:10 PM Robert Sparks via Datatracker <
[email-masked]> wrote:

> Robert Sparks has requested publication of
> draft-ietf-stir-enhance-rfc8226-02 as Proposed Standard on behalf of the
> STIR working group.
>
> Please verify the document's state at
> https://datatracker.ietf.org/doc/draft-ietf-stir-enhance-rfc8226/
>
>
>

---

From: Ben Campbell <[email-masked]>
Date: Thu, 27 May 2021 12:12:03 -0500

(dons shepherd hat)

The current quote usage seems to follow the convention of RFC 8226. One could argue about whether 8226 did it right, but it is what it is.

(I’d argue that “orig” refers to a human-readable-text JWT claim, thus the quotes, while mustInclude refers to an X.509 extension encoded in ASN.1. But that would be just making up stuff.)

Thanks!

Ben.

> On May 27, 2021, at 11:11 AM, Murray S. Kucherawy <[email-masked]> wrote:
> 
> A brief AD review; I'm going to Last Call this now as my feedback is minor, so please just factor this in as Last Call feedback:
> 
> In Section 3 (and later), stuff like mustInclude and permittedValues aren't quoted, but smaller things like "iat", "orig", and "dest" are.  More generally I found the use or non-use of quotes felt inconsistent.  I don't have a preferred solution, just something to consider.  I don't know what, if anything, the RFC Editor might do if they observe the same.
> 
> -MSK
> 
> 
> 
> 
> On Tue, May 25, 2021 at 1:10 PM Robert Sparks via Datatracker <[email-masked] <mailto:[email-masked]>> wrote:
> Please verify the document's state at https://datatracker.ietf.org/doc/draft-ietf-stir-enhance-rfc8226/ <https://datatracker.ietf.org/doc/draft-ietf-stir-enhance-rfc8226/>
> 
> 
> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir

---

From: Robert Sparks <[email-masked]>
Date: Thu, 27 May 2021 12:19:23 -0500

Note how claims are discussed in RFC7519.

RjS

On 5/27/21 12:12 PM, Ben Campbell wrote:
> (dons shepherd hat)
>
> The current quote usage seems to follow the convention of RFC 8226. 
> One could argue about whether 8226 did it right, but it is what it is.
>
> (I’d argue that “orig” refers to a human-readable-text JWT claim, thus 
> the quotes, while mustInclude refers to an X.509 extension encoded in 
> ASN.1. But that would be just making up stuff.)
>
> Thanks!
>
> Ben.
>
>
>> On May 27, 2021, at 11:11 AM, Murray S. Kucherawy 
>> <[email-masked] <mailto:[email-masked]>> wrote:
>>
>> A brief AD review; I'm going to Last Call this now as my feedback is 
>> minor, so please just factor this in as Last Call feedback:
>>
>> In Section 3 (and later), stuff like mustInclude and permittedValues 
>> aren't quoted, but smaller things like "iat", "orig", and "dest" 
>> are.  More generally I found the use or non-use of quotes felt 
>> inconsistent.  I don't have a preferred solution, just something to 
>> consider.  I don't know what, if anything, the RFC Editor might do if 
>> they observe the same.
>>
>> -MSK
>>
>>
>>
>>
>> On Tue, May 25, 2021 at 1:10 PM Robert Sparks via Datatracker 
>> <[email-masked] <mailto:[email-masked]>> wrote:
>>
>>     draft-ietf-stir-enhance-rfc8226-02 as Proposed Standard on behalf
>>     of the STIR working group.
>>
>>     <https://datatracker.ietf.org/doc/draft-ietf-stir-enhance-rfc8226/>
>>
>>
>> [email-masked] <mailto:[email-masked]>

---

From: Ben Campbell <[email-masked]>
Date: Thu, 27 May 2021 12:26:36 -0500

Ah, now that you mention that, the claim names are quoted in the JSON itself. 

> On May 27, 2021, at 12:19 PM, Robert Sparks <[email-masked]> wrote:
> 
>>> On May 27, 2021, at 11:11 AM, Murray S. Kucherawy <[email-masked] <mailto:[email-masked]>> wrote:
>>> 
>>> https://www.ietf.org/mailman/listinfo/stir <https://www.ietf.org/mailman/listinfo/stir>
>> 
>> 
>> 
>> https://www.ietf.org/mailman/listinfo/stir <https://www.ietf.org/mailman/listinfo/stir>

---

From: Russ Housley <[email-masked]>
Date: Thu, 27 May 2021 13:57:26 -0400

Ben:

I did try to follow the conventions in RFC 8226.  That said, I'm happy to hear what might make the sepc easier to understand.

Russ

> On May 27, 2021, at 1:12 PM, Ben Campbell <[email-masked]> wrote:
> 
> (dons shepherd hat)
>

---

From: Ben Campbell <[email-masked]>
Date: Thu, 27 May 2021 13:28:47 -0500

Robert’s separate email points to the existing convention to quote JWT claims. Is there a convention one way or another for X.509 extensions?

Ben.

> On May 27, 2021, at 12:57 PM, Russ Housley <[email-masked]> wrote:
> 
> Ben:
> 
>> On May 27, 2021, at 1:12 PM, Ben Campbell <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> (dons shepherd hat)
>>

---

From: Russ Housley <[email-masked]>
Date: Thu, 27 May 2021 14:32:46 -0400

RFC 5280 docs not use quotes.  X.509 uses a different font, but that does not work here.

Russ

> On May 27, 2021, at 2:28 PM, Ben Campbell <[email-masked]> wrote:
> 
>> On May 27, 2021, at 12:57 PM, Russ Housley <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Ben:
>>

---

From: Ben Campbell <[email-masked]>
Date: Thu, 27 May 2021 13:59:41 -0500

It is my individual opinion that the target audience for this draft will be used to the established quoting conventions, and might find departure from those conventions to reduce readability. (I recognize that that doesn’t help people new to the subject matter—but those people will need to need to study the normative references anyway.)

But it’s not my call, of course :-)

Ben.

> On May 27, 2021, at 1:32 PM, Russ Housley <[email-masked]> wrote:
> 
>> On May 27, 2021, at 2:28 PM, Ben Campbell <[email-masked] <mailto:[email-masked]>> wrote:
>>