draft-ietf-stir-enhance-rfc8226-02.txt   draft-ietf-stir-enhance-rfc8226-03.txt 
Network Working Group R. Housley Network Working Group R. Housley
Internet-Draft Vigil Security Internet-Draft Vigil Security
Updates: 8226 (if approved) 15 April 2021 Updates: 8226 (if approved) 10 June 2021
Intended status: Standards Track Intended status: Standards Track
Expires: 17 October 2021 Expires: 12 December 2021
Enhanced JWT Claim Constraints for STIR Certificates Enhanced JWT Claim Constraints for STIR Certificates
draft-ietf-stir-enhance-rfc8226-02 draft-ietf-stir-enhance-rfc8226-03
Abstract Abstract
RFC 8226 provides a certificate extension to constrain the JWT claims RFC 8226 specifies the use of certificates for Secure Telephone
that can be included in the PASSporT as defined in RFC 8225. If the Identity Credentials, and these certificates are often called "STIR
signer includes a JWT claim outside the constraint boundaries, then Certificates". RFC 8226 provides a certificate extension to
the recipient will reject the entire PASSporT. This document defines constrain the JSON Web Token (JWT) claims that can be included in the
an additional way that the JWT claims can be constrained. Personal Assertion Token (PASSporT) as defined in RFC 8225. If the
PASSporT signer includes a JWT claim outside the constraint
boundaries, then the PASSporT recipient will reject the entire
PASSporT. This document updates RFC 8226 to define an additional way
that the JWT claims can be constrained.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/. Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on 17 October 2021. This Internet-Draft will expire on 12 December 2021.
Copyright Notice Copyright Notice
Copyright (c) 2021 IETF Trust and the persons identified as the Copyright (c) 2021 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/ Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document. license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components and restrictions with respect to this document. Code Components
extracted from this document must include Simplified BSD License text extracted from this document must include Simplified BSD License text
as described in Section 4.e of the Trust Legal Provisions and are as described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Simplified BSD License. provided without warranty as described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Enhanced JWT Claim Constraints Syntax . . . . . . . . . . . . 3 3. Enhanced JWT Claim Constraints Syntax . . . . . . . . . . . . 3
4. Usage Examples . . . . . . . . . . . . . . . . . . . . . . . 4 4. Usage Examples . . . . . . . . . . . . . . . . . . . . . . . 4
5. Certificate Extension Example . . . . . . . . . . . . . . . . 5 5. Certificate Extension Example . . . . . . . . . . . . . . . . 5
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
7. Security Considerations . . . . . . . . . . . . . . . . . . . 7 7. Security Considerations . . . . . . . . . . . . . . . . . . . 7
8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 8 8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 8
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 8 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 8
9.1. Normative References . . . . . . . . . . . . . . . . . . 8 9.1. Normative References . . . . . . . . . . . . . . . . . . 8
9.2. Informative References . . . . . . . . . . . . . . . . . 8 9.2. Informative References . . . . . . . . . . . . . . . . . 9
Appendix A. ASN.1 Module . . . . . . . . . . . . . . . . . . . . 9 Appendix A. ASN.1 Module . . . . . . . . . . . . . . . . . . . . 9
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 10 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 11
1. Introduction 1. Introduction
The use of certificates [RFC5280] in establishing authority over The use of certificates [RFC5280] in establishing authority over
telephone numbers is described in [RFC8226]. telephone numbers is described in [RFC8226]. These certificates are
often called "STIR Certificates". STIR certificates are an important
element of the overall system that prevents the impersonation of
telephone numbers on the Internet.
Section 8 of [RFC8226] provides a certificate extension to constrain Section 8 of [RFC8226] provides a certificate extension to constrain
the JWT claims that can be included in the PASSporT [RFC8225]. If the JSON Web Token (JWT) claims that can be included in the Personal
the signer includes a JWT claim outside the constraint boundaries, Assertion Token (PASSporT) [RFC8225]. If the PASSporT signer
then the recipient will reject the entire PASSporT. includes a JWT claim outside the constraint boundaries, then the
PASSporT recipient will reject the entire PASSporT.
This document defines an enhanced JWTClaimConstraints certificate This document defines an enhanced JWTClaimConstraints certificate
extension, which provides all of the capabilities available in the extension, which provides all of the capabilities available in the
original certificate extension as well as an additional way to original certificate extension as well as an additional way to
constrain the allowable JWT claims. That is, the enhanced extension constrain the allowable JWT claims. That is, the enhanced extension
can provide a list of claims that are not allowed to be included in can provide a list of claims that are not allowed to be included in
the PASSporT. the PASSporT.
The Enhanced JWT Claim Constraints certificate extension is needed to
limit the authority when a parent STIR certificate delegates to a
subordinate STIR certificate. For example,
[I-D.ietf-stir-cert-delegation] describes the situation where service
providers issue a STIR certificate to enterprises or other customers
to sign PASSporTs, and the Enhanced JWT Claim Constraints certificate
extension can be used to prevent specific claims from being included
in PASSporTs and accepted as valid by the PASSporT recipient.
The JWT Claim Constraints certificate extension defined in [RFC8226]
provides a list of claims that must be included in a valid PASSporT
as well as a list if permitted values for selected claims. The
Enhanced JWT Claim Constraints certificate extension defined in this
document includes those capabilities and adds a list of claims that
must not be included in a valid PASSporT.
2. Terminology 2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in "OPTIONAL" in this document are to be interpreted as described in
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here. capitals, as shown here.
3. Enhanced JWT Claim Constraints Syntax 3. Enhanced JWT Claim Constraints Syntax
The Enhanced JWT Claim Constraints certificate extension limits the The Enhanced JWT Claim Constraints certificate extension is non-
PASSporT claims and the claim values that can successfully validated critical, applicable only to end-entity certificates, and defined
by the certificate that contains the extension. Certificate issuers with ASN.1 [X.680]. The syntax of the JWT claims in a PASSporT is
permit all claims by omitting the Enhanced JWT Claim Constraints specified in [RFC8225].
certificate extension from the extension field of the certificate
[RFC5280]. The certificate extension is non-critical, applicable
only to end-entity certificates, and defined with ASN.1 [X.680]. The
syntax of the JWT claims in a PASSporT is specified in [RFC8225].
The Enhanced JWT Claim Constraints certificate extension is optional, The Enhanced JWT Claim Constraints certificate extension is optional,
but when present, it constrains the JWT claims that authentication but when present, it constrains the JWT claims that authentication
services may include in the PASSporT objects they sign. Constraints services may include in the PASSporT objects they sign. Constraints
are applied by certificate issuers and enforced by recipients when are applied by certificate issuers and enforced by recipients when
validating PASSporT claims as follows: validating PASSporT claims as follows:
1. mustInclude indicates JWT claims that MUST appear in the PASSporT 1. mustInclude indicates JWT claims that MUST appear in the PASSporT
in addition to the iat, orig, and dest claims. The baseline in addition to the iat, orig, and dest claims. The baseline
PASSporT claims ("iat", "orig", and "dest") are considered to be PASSporT claims ("iat", "orig", and "dest") are considered to be
skipping to change at page 4, line 36 skipping to change at page 4, line 49
JWTClaimName ::= IA5String JWTClaimName ::= IA5String
4. Usage Examples 4. Usage Examples
Consider these usage examples with a PASSporT claim called Consider these usage examples with a PASSporT claim called
"confidence" with values "low", "medium", and "high". These examples "confidence" with values "low", "medium", and "high". These examples
illustrate the constraints that are imposed by mustInclude, illustrate the constraints that are imposed by mustInclude,
permittedValues, and mustExclude: permittedValues, and mustExclude:
* If a CA issues to an authentication service certificate that * If a CA issues a certificate to an authentication service that
includes an Enhanced JWT Claim Constraints certificate extension includes an Enhanced JWT Claim Constraints certificate extension
that contains the mustInclude JWTClaimName "confidence", then an that contains the mustInclude JWTClaimName "confidence", then an
authentication service is required to include the "confidence" authentication service is required to include the "confidence"
claim in all PASSporTs it generates and signs; a verification claim in all PASSporTs it generates and signs. A verification
service will treat as invalid any PASSporT it receives without a service will treat as invalid any PASSporT it receives without a
"confidence" PASSporT claim. "confidence" PASSporT claim.
* If a CA issues to an authentication service certificate that * If a CA issues a certificate to an authentication service that
includes an Enhanced JWT Claim Constraints certificate extension includes an Enhanced JWT Claim Constraints certificate extension
that contains the permittedValues JWTClaimName "confidence" and a that contains the permittedValues JWTClaimName "confidence" and a
permitted "high" value, then a verification service will treat as permitted "high" value, then a verification service will treat as
invalid any PASSporT it receives with a PASSporT "confidence" invalid any PASSporT it receives with a PASSporT "confidence"
claim with a value other than "high". However, a verification claim with a value other than "high". However, a verification
service will not treat as invalid a PASSporT it receives without a service will not treat as invalid a PASSporT it receives without a
PASSporT "confidence" claim at all. PASSporT "confidence" claim at all.
* If a CA issues to an authentication service certificate that * If a CA issues a certificate to an authentication service that
includes an Enhanced JWT Claim Constraints certificate extension includes an Enhanced JWT Claim Constraints certificate extension
that contains the mustExclude JWTClaimName "confidence", then a that contains the mustExclude JWTClaimName "confidence", then a
verification service will treat as invalid any PASSporT it verification service will treat as invalid any PASSporT it
receives with a PASSporT "confidence" claim regardless of the receives with a PASSporT "confidence" claim regardless of the
claim value. claim value.
5. Certificate Extension Example 5. Certificate Extension Example
A certificate containing an example of the A certificate containing an example of the
EnhancedJWTClaimConstraints certificate extension is provided in EnhancedJWTClaimConstraints certificate extension is provided in
skipping to change at page 7, line 30 skipping to change at page 8, line 5
that are not listed in the JWTClaimValuesList are prohibited in a that are not listed in the JWTClaimValuesList are prohibited in a
valid PASSporT. valid PASSporT.
Certificate issuers must take care when imposing constraints on the Certificate issuers must take care when imposing constraints on the
PASSporT claims and the claim values that can successfully validated; PASSporT claims and the claim values that can successfully validated;
some combinations can prevent any PASSporT from being successfully some combinations can prevent any PASSporT from being successfully
validated by the certificate. For example, an entry in mustInclude validated by the certificate. For example, an entry in mustInclude
and an entry in mustExclude for the same claim will prevent and an entry in mustExclude for the same claim will prevent
successful validation on any PASSporT. successful validation on any PASSporT.
Certificate issuers must take care when imposing constraints on the
PASSporT claims and the claim values that can successfully validated;
some combinations can prevent any PASSporT from being successfully
validated by the certificate. For example, an entry in mustInclude
and an entry in mustExclude for the same claim will prevent
successful validation on any PASSporT.
Certificate issuers should not include an entry in mustExclude for Certificate issuers should not include an entry in mustExclude for
the "rcdi" claim for a certificate that will be used with the the "rcdi" claim for a certificate that will be used with the
PASSporT Extension for Rich Call Data defined in PASSporT Extension for Rich Call Data defined in
[I-D.ietf-stir-passport-rcd]. Excluding this claim would prevent the [I-D.ietf-stir-passport-rcd]. Excluding this claim would prevent the
integrity protection mechanism from working properly. integrity protection mechanism from working properly.
Certificate issuers must take care when performing certificate Certificate issuers must take care when performing certificate
renewal [RFC4949] to include exactly the same Enhanced JWT Claim renewal [RFC4949] to include exactly the same Enhanced JWT Claim
Constraints certificate extension in the new certificate as the old Constraints certificate extension in the new certificate as the old
one. Renewal usually takes place before the old certificate expires, one. Renewal usually takes place before the old certificate expires,
skipping to change at page 8, line 10 skipping to change at page 8, line 26
old certificate are valid. If different constraints appear in the old certificate are valid. If different constraints appear in the
two certificates with the same public key, some PASSporTs might be two certificates with the same public key, some PASSporTs might be
valid when one certificate is used and invalid when the other one is valid when one certificate is used and invalid when the other one is
used. used.
8. Acknowledgements 8. Acknowledgements
Many thanks to Chris Wendt for his insight into the need for the for Many thanks to Chris Wendt for his insight into the need for the for
the Enhanced JWT Claim Constraints certificate extension. the Enhanced JWT Claim Constraints certificate extension.
Thanks to Ben Campbell for the thoughtful review and comments. The Thanks to Ben Campbell and Theresa Enghardt for the thoughtful review
document is much better as a result of the comments. and comments. The document is much better as a result of the
comments.
9. References 9. References
9.1. Normative References 9.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997, DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>. <https://www.rfc-editor.org/info/rfc2119>.
skipping to change at page 9, line 5 skipping to change at page 9, line 21
DOI 10.17487/RFC8226, February 2018, DOI 10.17487/RFC8226, February 2018,
<https://www.rfc-editor.org/info/rfc8226>. <https://www.rfc-editor.org/info/rfc8226>.
[X.680] International Telecommunication Union, "Information [X.680] International Telecommunication Union, "Information
Technology - Abstract Syntax Notation One (ASN.1): Technology - Abstract Syntax Notation One (ASN.1):
Specification of basic notation", ISO/IEC 8824-1, August Specification of basic notation", ISO/IEC 8824-1, August
2021. 2021.
9.2. Informative References 9.2. Informative References
[I-D.ietf-stir-cert-delegation]
Peterson, J., "STIR Certificate Delegation", Work in
Progress, Internet-Draft, draft-ietf-stir-cert-delegation-
04, 22 February 2021, <https://www.ietf.org/archive/id/
draft-ietf-stir-cert-delegation-04.txt>.
[I-D.ietf-stir-passport-rcd] [I-D.ietf-stir-passport-rcd]
Peterson, J. and C. Wendt, "PASSporT Extension for Rich Wendt, C. and J. Peterson, "PASSporT Extension for Rich
Call Data", Work in Progress, Internet-Draft, draft-ietf- Call Data", Work in Progress, Internet-Draft, draft-ietf-
stir-passport-rcd-09, 18 November 2020, stir-passport-rcd-11, 29 March 2021,
<http://www.ietf.org/internet-drafts/draft-ietf-stir- <https://www.ietf.org/archive/id/draft-ietf-stir-passport-
passport-rcd-09.txt>. rcd-11.txt>.
[RFC4949] Shirey, R., "Internet Security Glossary, Version 2", [RFC4949] Shirey, R., "Internet Security Glossary, Version 2",
FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007, FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007,
<https://www.rfc-editor.org/info/rfc4949>. <https://www.rfc-editor.org/info/rfc4949>.
[RFC7468] Josefsson, S. and S. Leonard, "Textual Encodings of PKIX, [RFC7468] Josefsson, S. and S. Leonard, "Textual Encodings of PKIX,
PKCS, and CMS Structures", RFC 7468, DOI 10.17487/RFC7468, PKCS, and CMS Structures", RFC 7468, DOI 10.17487/RFC7468,
April 2015, <https://www.rfc-editor.org/info/rfc7468>. April 2015, <https://www.rfc-editor.org/info/rfc7468>.
Appendix A. ASN.1 Module Appendix A. ASN.1 Module
 End of changes. 22 change blocks. 
42 lines changed or deleted 62 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/