Subject: [stir] Comments on draft-peterson-stir-cnam-02

From: Robert Sparks <[email-masked]>
Date: Fri, 16 Jun 2017 10:05:01 -0500

The document currently uses "Third party PASSport" too generically. It 
needs to
say "Third party cnam PASSport" or something similar so it doesn't restrict
other extensions that might involve a third party.

In the context of the discussion at "Relying parties in STIR have always
been left to make thier own authorization decisions": It's not yet clear
to me from the text that we require _both_ an attestation of "orig" from
a proper authority and an attestation of "cnam", especially when the
authorities are different. What text do we have that keeps a pasted
cnam passport with some non-matching "orig" from being treated as valid?

It would be good to specify _where_ in the IANA registries to put the 
CNA types registry. (We put the extension name registry too high in the 
hierarchy perhaps.)

Nits:

Introduction first paragraph: third sentence (starts with "This 
specification
documents"). This sentence gets complicated around ", provided it". Can 
it be
simplified?

Is the last paragraph of section 4 an introduction to section 5? If so,
consider moving it into section 5.

The last two sentences of the first paragraph of section 5 are hard to 
get through. Simplifying the next to last sentence would help, but you 
may be able to make the point more simply.

---

From: "Peterson, Jon" <[email-masked]>
Date: Fri, 16 Jun 2017 17:48:19 +0000

Thanks for nits and notes, definitely we should keep straight what we mean
by third parties here.

>cnam passport with some non-matching "orig" from being treated as valid?

What we're trying to do by having "orig" and "cnam" under a signature from
the same authority is to bind the "cna" to the call from a particular
number (or whatever originating identifier) that someone is trying to set
up. I mean, for the third party case we could effectively use a different
claim to represent the telephone number, one that doesn't have the
semantics of "this is the originator of a telephone call" - like say the
JWT claim for phone_number already in the IANA registry. But the design
goal here is to mirror the syntax of the first party case here, and also
to make it clear that the third-party "cna" is data about a -call-, not
just a number. Maybe if we made that distinction clearer in the text, it
would help explain the design rationale.

>CNA types registry. (We put the extension name registry too high in the

Roger.

Jon Peterson
Neustar, Inc.