ATIS/SIP Forum IP-NNI Task Force

 View Only
Back to discussions
Expand all | Collapse all

IPNNI-2024-00049R000.docx uploaded

  • 1.  IPNNI-2024-00049R000.docx uploaded

    Posted 10-04-2024 02:57:00 PM
    Document Name: IPNNI-2024-00049R000.docx
    Description
    Issue Statement/Business Need:

    STI-CAs verify that the SPC Token has not expired by looking at the
    “exp” claim. However, STI-CAs have no way of knowing when the SPC Token
    was issued. This prevents STI-CAs from enforcing stricter policies, for
    example, that SPC Tokens must be short lived (e.g., 1-day). The STI-PA
    could include an “iat” claim which would enable STI-CAs to determine if
    an SPC Token is short lived or not.

    STI-CAs are required to put the name of the entity they issued the
    certificate to in the certificate’s subject organization name. However,
    in practice this name often does not match the name the STI-PA uses to
    identify the service provider, which causes confusion. If the STI-PA
    included a “sub” claim in the SPC Token, the STI-CA could use this name
    which would ensure the names used by the STI-CA and STI-PA match. The
    STI-PA already collects the name of each service provider.

    The US CP allows either ecdsa-with-sha256 or ecdsa-with-sha384 certificate
    signature algorithms. ATIS-1000080.v005 only allows ecdsa-with-sha256.
    ATIS-1000080 should not conflict with the US CP.

    The US CP allows either P-256 or P-384 public key curves. ATIS-1000080.v005
    only allows P-256. ATIS-1000080 should not conflict with the US CP.

    Suggested Solution:

    Publish ATIS-1000080.v006 with:
    1. “iat” claim added to the SPC Token so STI-CAs can identify if SPC
    Tokens are short lived,
    2. “sub” claim added to the SPC Token so STI-CAs can use the same name
    in the certificate that the STI-PA uses,
    3. ecdsa-with-sha384 added as an allowed certificate signature algorithm to
    match the US CP, and
    4. P-384 added as an allowed public key curve to match the US CP.
    Download Latest Revision
    Public Download Link
    Submitter: Alec Fenichel
    Group: ATIS/SIP Forum IP-NNI Task Force
    Folder: 2024
    Date submitted: 2024-10-04 18:56:35


Related Content