Document Name: IPNNI-2024-00049R001.docx
Description
Issue Statement/Business Need:
STI-CAs verify that the SPC Token has not expired by looking at the
“exp” claim. However, STI-CAs have no way of knowing when the SPC Token
was issued. This prevents STI-CAs from enforcing stricter policies, for
example, that SPC Tokens must be short lived (e.g., 1-day). The STI-PA
could include an “iat” claim which would enable STI-CAs to determine if
an SPC Token is short lived or not.
STI-CAs are required to put the name of the entity they issued the
certificate to in the certificate’s subject organization name. However,
in practice this name often does not match the name the STI-PA uses to
identify the service provider, which causes confusion. If the STI-PA
included a “sub” claim in the SPC Token, the STI-CA could use this name
which would ensure the names used by the STI-CA and STI-PA match. The
STI-PA already collects the name of each service provider.
The US CP allows either ecdsa-with-sha256 or ecdsa-with-sha384 certificate
signature algorithms. ATIS-1000080.v005 only allows ecdsa-with-sha256.
ATIS-1000080 should not conflict with the US CP.
The US CP allows either P-256 or P-384 public key curves. ATIS-1000080.v005
only allows P-256. ATIS-1000080 should not conflict with the US CP.
Suggested Solution:
Publish ATIS-1000080.v006 with:
1. “iat” claim added to the SPC Token so STI-CAs can identify if SPC
Tokens are short lived,
2. “sub” claim added to the SPC Token so STI-CAs can use the same name
in the certificate that the STI-PA uses,
3. ecdsa-with-sha384 added as an allowed certificate signature algorithm to
match the US CP, and
4. P-384 added as an allowed public key curve to match the US CP.
Download Latest Revision
Public Download Link
Submitter: Anna Karditzas
Group: ATIS/SIP Forum IP-NNI Task Force
Folder: 2024
Date submitted: 2024-10-15 16:20:42
Revision: 1
|
---------------------------------
Anna Karditzas
ATIS, Senior Coordinator - Global Standards Development
+1 (202) 434-8843
akarditzas@atis.org---------------------------------