From nobody Thu Jun 14 08:09:40 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3855F130E43 for ; Thu, 14 Jun 2018 08:09:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y5DYUxAsYNUU for ; Thu, 14 Jun 2018 08:09:35 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 70D13130E29 for ; Thu, 14 Jun 2018 08:09:35 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 41CC0300A3C for ; Thu, 14 Jun 2018 11:09:33 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id df5s3md7DC7j for ; Thu, 14 Jun 2018 11:09:32 -0400 (EDT) Received: from a860b60074bd.home (pool-71-127-50-4.washdc.fios.verizon.net [71.127.50.4]) by mail.smeinc.net (Postfix) with ESMTPSA id 8FE8830044B for ; Thu, 14 Jun 2018 11:09:32 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Thu, 14 Jun 2018 11:09:36 -0400 References: <50B8E2C5-4496-4431-A151-4E5A986B78E8@vigilsec.com> To: IETF STIR Mail List In-Reply-To: <50B8E2C5-4496-4431-A151-4E5A986B78E8@vigilsec.com> Message-Id: X-Mailer: Apple Mail (2.3273) Archived-At: Subject: [stir] STIR Agenda Items for IETF 102 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Jun 2018 15:09:39 -0000 Below is the DRAFT agenda for the STIR session in Montreal. Please = review and comment. Russ =3D =3D =3D =3D =3D =3D =3D =3D =3D=20 DRAFT STIR WG Agenda for IETF 102 0) Minute Taker, Jabber Scribe, Bluesheets 1) Agenda Bash 2) Documents that have been sent to the IESG a) draft-ietf-stir-rph (Ray, Martin, Subir, and An) 3) Active Working Group Documents a) draft-ietf-stir-passport-shaken (Chris and Mary) b) draft-ietf-stir-passport-divert (Jon) c) draft-ietf-stir-oob (EKR and Jon) 4) Other Business (if time allows) a) please contact the WG chairs if you want to present 5) Wrap Up From nobody Thu Jun 14 13:03:41 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE3D9130E88 for ; Thu, 14 Jun 2018 12:52:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vncIqJNiLcc4 for ; Thu, 14 Jun 2018 12:52:48 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4690130E70 for ; Thu, 14 Jun 2018 12:52:48 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 33427B80638; Thu, 14 Jun 2018 12:52:46 -0700 (PDT) To: jon.peterson@neustar.biz, fluffy@cisco.com, ekr@rtfm.com, chris-ietf@chriswendt.net, ben@nostrum.com, aamelnikov@fastmail.fm, adam@nostrum.com, rjsparks@nostrum.com, housley@vigilsec.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: tasveren@rbbn.com, stir@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20180614195246.33427B80638@rfc-editor.org> Date: Thu, 14 Jun 2018 12:52:46 -0700 (PDT) Archived-At: X-Mailman-Approved-At: Thu, 14 Jun 2018 13:03:39 -0700 Subject: [stir] [Technical Errata Reported] RFC8224 (5390) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Jun 2018 19:52:51 -0000 The following errata report has been submitted for RFC8224, "Authenticated Identity Management in the Session Initiation Protocol (SIP)". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5390 -------------------------------------- Type: Technical Reported by: Invalid restriction on when to add "mky" Section: 12.1 Original Text ------------- When signing a request that contains a fingerprint of keying material in SDP for DTLS-SRTP [RFC5763], this mechanism always provides a signature over that fingerprint. Corrected Text -------------- When signing a request that contains a fingerprint of keying material in SDP, this mechanism always provides a signature over that fingerprint. Notes ----- Attack vector described in 12.1 to justify addition of "mky" is applicable for scenarios, where a fingerprint in SDP is used for reasons other than DTLS-STRP as well. Use of fingerprint for MSRP per RFCRFC4975 is an example of this. >From RFC4975: 14.4. Using TLS in Peer-to-Peer Mode TLS can be used with a self-signed certificate as long as there is a mechanism for both sides to ascertain that the other side used the correct certificate. When used with SDP and SIP, the correct certificate can be verified by passing a fingerprint of the certificate in the SDP and ensuring that the SDP has suitable integrity protection. When SIP is used to transport the SDP, the integrity can be provided by the SIP Identity mechanism [17]. The rest of this section describes the details of this approach. Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC8224 (draft-ietf-stir-rfc4474bis-16) -------------------------------------- Title : Authenticated Identity Management in the Session Initiation Protocol (SIP) Publication Date : February 2018 Author(s) : J. Peterson, C. Jennings, E. Rescorla, C. Wendt Category : PROPOSED STANDARD Source : Secure Telephone Identity Revisited Area : Applications and Real-Time Stream : IETF Verifying Party : IESG From nobody Thu Jun 14 13:56:24 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2A4E13115A for ; Thu, 14 Jun 2018 13:15:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I_tZ-iMW9u0k for ; Thu, 14 Jun 2018 13:15:43 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 99496130F65 for ; Thu, 14 Jun 2018 13:15:43 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 16914B812B8; Thu, 14 Jun 2018 13:15:41 -0700 (PDT) To: jon.peterson@neustar.biz, fluffy@cisco.com, ekr@rtfm.com, chris-ietf@chriswendt.net, ben@nostrum.com, aamelnikov@fastmail.fm, adam@nostrum.com, rjsparks@nostrum.com, housley@vigilsec.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: tasveren@rbbn.com, stir@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20180614201541.16914B812B8@rfc-editor.org> Date: Thu, 14 Jun 2018 13:15:41 -0700 (PDT) Archived-At: X-Mailman-Approved-At: Thu, 14 Jun 2018 13:56:21 -0700 Subject: [stir] [Technical Errata Reported] RFC8224 (5391) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Jun 2018 20:15:54 -0000 The following errata report has been submitted for RFC8224, "Authenticated Identity Management in the Session Initiation Protocol (SIP)". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5391 -------------------------------------- Type: Technical Reported by: Invalid content for "iat" Section: 4.1 Original Text ------------- Third, the JSON key "iat" MUST appear. The authentication service SHOULD set the value of "iat" to an encoding of the value of the SIP Date header field as a JSON NumericDate (as UNIX time, per [RFC7519], Section 2), though an authentication service MAY set the value of "iat" to its own current clock time. If the authentication service uses its own clock time, then the use of the full form of PASSporT is REQUIRED. In either case, the authentication service MUST NOT generate a PASSporT for a SIP request if the Date header is outside of its local policy for freshness (sixty seconds is RECOMMENDED). Corrected Text -------------- “4.1 PASSPorT Construction”: Third, the JSON key "iat" MUST appear. The authentication service SHOULD set the value of "iat" to an encoding of the value of JWT generation as a JSON NumericDate (as UNIX time, per [RFC7519], Section 2). Notes ----- RFC7519 JSON Web Token (JWT) 4.1.6. "iat" (Issued At) Claim The "iat" (issued at) claim identifies the time at which the JWT was issued. This claim can be used to determine the age of the JWT. Its value MUST be a number containing a NumericDate value. Use of this claim is OPTIONAL. This text clearly states that “iat” is for the generation time of JWS. One may argue that origination of SIP dialog - on which Date header content is based - and JWT generation times would be very close to each other but this is not always true. JWT, for example, can be added only at administrative boundaries and a session may have started long before that,e .g. it involves user interaction with an IVR for announcement/PIN verification. It should be noted that populating "iat" with JWT issuance time makes use of complete form mandatory. So, if this errata is accepted, there probably would be a need to remove compact form as an option. Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC8224 (draft-ietf-stir-rfc4474bis-16) -------------------------------------- Title : Authenticated Identity Management in the Session Initiation Protocol (SIP) Publication Date : February 2018 Author(s) : J. Peterson, C. Jennings, E. Rescorla, C. Wendt Category : PROPOSED STANDARD Source : Secure Telephone Identity Revisited Area : Applications and Real-Time Stream : IETF Verifying Party : IESG From nobody Thu Jun 14 13:56:28 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 93775130E70 for ; Thu, 14 Jun 2018 13:21:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cBadK29mk6DT for ; Thu, 14 Jun 2018 13:21:46 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B866D130F50 for ; Thu, 14 Jun 2018 13:21:46 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 3B94DB81A01; Thu, 14 Jun 2018 13:21:44 -0700 (PDT) To: chris-ietf@chriswendt.net, jon.peterson@neustar.biz, ben@nostrum.com, aamelnikov@fastmail.fm, adam@nostrum.com, rjsparks@nostrum.com, housley@vigilsec.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: tasveren@rbbn.com, stir@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20180614202144.3B94DB81A01@rfc-editor.org> Date: Thu, 14 Jun 2018 13:21:44 -0700 (PDT) Archived-At: X-Mailman-Approved-At: Thu, 14 Jun 2018 13:56:21 -0700 Subject: [stir] [Technical Errata Reported] RFC8225 (5392) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Jun 2018 20:21:55 -0000 The following errata report has been submitted for RFC8225, "PASSporT: Personal Assertion Token". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5392 -------------------------------------- Type: Technical Reported by: Invalid "iat" content Section: 5.1.1 Original Text ------------- The JSON claim MUST include the "iat" (Issued At) claim ([RFC7519], Section 4.1.6). As defined, the "iat" claim should be set to the date and time of issuance of the JWT and MUST indicate the date and time of the origination of the personal communications. The time value should be of the NumericDate format as defined in [RFC7519], Section 2. This is included for securing the token against replay and cut-and-paste attacks, as explained further in Section 10 ("Security Considerations"). Corrected Text -------------- The JSON claim MUST include the "iat" (Issued At) claim ([RFC7519], Section 4.1.6). As defined, the "iat" claim should be set to the date and time of issuance of the JWT. The time value should be of the NumericDate format as defined in [RFC7519], Section 2. This is included for securing the token against replay and cut-and-paste attacks, as explained further in Section 10 ("Security Considerations"). Notes ----- It is mentioned that “iat” should be set based on issuance of JWT (which would be when PASSPorT is constructed). OTOH, it is also stated that it MUST indicate the date and time of the origination of the personal communication. The former seems to be the right approach as what we would like to protect against cut-and-paste attacks is the PASSPorT in the context of a particular communication session. The times for these two events are not necessarily the same/close enough to be considered the same. RFC7519 JSON Web Token (JWT) 4.1.6. "iat" (Issued At) Claim The "iat" (issued at) claim identifies the time at which the JWT was issued. This claim can be used to determine the age of the JWT. Its value MUST be a number containing a NumericDate value. Use of this claim is OPTIONAL. This text clearly states that “iat” is for the generation time of JWS. Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC8225 (draft-ietf-stir-passport-11) -------------------------------------- Title : PASSporT: Personal Assertion Token Publication Date : February 2018 Author(s) : C. Wendt, J. Peterson Category : PROPOSED STANDARD Source : Secure Telephone Identity Revisited Area : Applications and Real-Time Stream : IETF Verifying Party : IESG From nobody Tue Jun 19 13:17:12 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D020130E31 for ; Tue, 19 Jun 2018 13:17:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K8nziG6exJEw for ; Tue, 19 Jun 2018 13:17:04 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE389130ECA for ; Tue, 19 Jun 2018 13:17:04 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 62612300A12 for ; Tue, 19 Jun 2018 16:17:02 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 08leWCaLQAh5 for ; Tue, 19 Jun 2018 16:17:01 -0400 (EDT) Received: from a860b60074bd.home (pool-71-127-50-4.washdc.fios.verizon.net [71.127.50.4]) by mail.smeinc.net (Postfix) with ESMTPSA id EDCBD3004FE for ; Tue, 19 Jun 2018 16:17:00 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Tue, 19 Jun 2018 16:17:02 -0400 References: <50B8E2C5-4496-4431-A151-4E5A986B78E8@vigilsec.com> To: IETF STIR Mail List In-Reply-To: Message-Id: X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [stir] STIR Agenda Items for IETF 102 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Jun 2018 20:17:10 -0000 Here is the updated DRAFT Agenda at this point ... Russ = = = = = = = = STIR WG Agenda for IETF 102 0) Minute Taker, Jabber Scribe, Bluesheets 1) Agenda Bash 2) Documents that have been sent to the IESG a) draft-ietf-stir-rph (Ray, Martin, Subir, and An) 3) Active Working Group Documents a) draft-ietf-stir-passport-shaken (Chris and Mary) b) draft-ietf-stir-passport-divert (Jon) c) draft-ietf-stir-oob (EKR and Jon) 4) Errata a) Technical Errata Reported on RFCs 8224 and 8225 (Tolga) 5) Other Business (if time allows) a) draft-barnes-stir-passport-div-hi-callflows-00 (Mary) b) draft-asveren-stir-p-charge-info-00 (Tolga) 6) Wrap Up