Subject: [stir] Comments on draft-singh-stir-rph-00

From: Robert Sparks <[email-masked]>
Date: Fri, 16 Jun 2017 10:18:10 -0500

1) I'm not sure why we need to the label "Resource-Priority" in

{"auth":"Resource-Priority: ets.0"}

Why isn't that simply

{"auth":"ets.0"}?

or

{"rp":"ets.0"}?

2) Clarify whether you are looking for the possibility that a different 
authority signs this claim or if you're always expecting this claim to 
be signed by the same authority as the base claims. If they can be 
different (and we're talking separate passports), some additional 
description of the verification logic is needed to help address 
cut-paste attacks.

3) In section 4.2, is the implication that the compact form of passport 
is not allowed when using this extension? If so, saying that explicitly 
would be better.

4) Could you say more about the first bullet in 7.2 - it's not clear 
it's salient to this particular spec?

5) (Minor thing, probably in the weeds) : Is there a use case in the 
real world now where a user gets an enhanced priority, but is only 
allowed to use it once? If so, this spec should call out that this 
mechanism doesn't restrict the user to one call. They can call as many 
times as they can send an INVITE within the acceptable iat window and 
have the assertions check out. There will be out-of-protocol 
consequences of course...

Nits:

The first paragraph of 7.1 has a sentence that doesn't parse starting at 
"A uniqueness of the set"

Text two bullets look like they're repeating the base spec and probably 
don't need to be here?

---

From: "DOLLY, MARTIN C" <[email-masked]>
Date: Sat, 17 Jun 2017 12:34:23 +0000

Robert,

1. ok, we'll change it to, {"auth":"ets.0"}
2. there is one authority or delegate-authority per claim
3. Correct, the compact form is not allowed with this extension, and we will add explicit wording
4. we will remove the bullet
5. This depends on the "namespace": 
5a. Civil emergency (e.g., 911) is an example of use is once (on that emergency call
5b. NS/EP (ets, wps) on a per session request where the user's priority is static
5c. MCPTT, the user has a default priority level which can change dynamically based on the user's role changing (e.g., patrol person is the first at the scene of an incident, the user's priority level is elevated till the SWAT team arrives)
	We can add clarifying text

Ok with NITs

We will submit an update prior to the Internet Draft submission cut-off

Thank you,

Martin

-----Original Message-----
From: stir [mailto:[email-masked]] On Behalf Of Robert Sparks
Sent: Friday, June 16, 2017 11:18 AM
To: [email-masked]
Subject: [stir] Comments on draft-singh-stir-rph-00

Why isn't that simply

{"auth":"ets.0"}?

or

{"rp":"ets.0"}?

2) Clarify whether you are looking for the possibility that a different authority signs this claim or if you're always expecting this claim to be signed by the same authority as the base claims. If they can be different (and we're talking separate passports), some additional description of the verification logic is needed to help address cut-paste attacks.

3) In section 4.2, is the implication that the compact form of passport is not allowed when using this extension? If so, saying that explicitly would be better.

4) Could you say more about the first bullet in 7.2 - it's not clear it's salient to this particular spec?

5) (Minor thing, probably in the weeds) : Is there a use case in the real world now where a user gets an enhanced priority, but is only allowed to use it once? If so, this spec should call out that this mechanism doesn't restrict the user to one call. They can call as many times as they can send an INVITE within the acceptable iat window and have the assertions check out. There will be out-of-protocol consequences of course...

Nits:

_______________________________________________
stir mailing list
[email-masked]
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_stir&d=DwICAg&c=LFYZ-o9_HUMeMTSQicvjIg&r=G9v8uCSSQhCmpw7ItG0r2g&m=XslLKBdaGua2zf9xq7arYhp374YsWCx-g-JuBylCC5k&s=DbmdUmAxKEidNwKqvXCqfyimvTMFL7zNWrssCpdci6I&e=