Subject: [stir] stir-06: JWT vs UAC time

From: Eric Burger <[email-masked]>
Date: Thu, 10 Dec 2015 21:15:55 -0500

Section 7 defines the issued at JWT value (iat) as the time the UAC asserts in the SIP message:
      Third, the JSON key "iat" followed by a colon and then a quoted
      encoding of the value of the SIP Date header field [EB1] as a JSON
      NumericDate (as UNIX time, per [RFC7519] Section 2)/

Do we really want to do that? I think there is value in either the authenticator barfing if the SIP time is too old or the validator barfing because the SIP time is way different than the authenticator issued time. I do not like the idea of the validator lying on behalf of the UAC.

---

From: "Peterson, Jon" <[email-masked]>
Date: Tue, 15 Dec 2015 17:55:08 +0000

I'm not sure how the text is different from what you seem to want.
Ordinarily, the authentication service adds the iat to the JWT object by
copying the value form the Date, but if the Date is stale when the
authentication service receives the request, clearly it can (and SHOULD)
barf then and refuse to sign the request (this is spelled out in 4.1 step
3). A verification service similarly should fail the validation if the
Date is stale (4.2 step 4), as the iat is merely a signed copy of the
Date. That is the intended design, anyway.

However, do bear in mind that middleboxes acting as authentication
services can arbitrarily modify SIP requests and thus "lie" about whatever
they want before generating the signature; that is more than just a side
effect of the design, it is a requirement.

Jon Peterson
Neustar, Inc.

On 12/10/15, 6:15 PM, "stir on behalf of Eric Burger"
<[email-masked] on behalf of [email-masked]> wrote:

>Do we really want to do that? I think there is value in either the
>authenticator barfing if the SIP time is too old or the validator barfing
>because the SIP time is way different than the authenticator issued time.
>I do not like the idea of the validator lying on behalf of the UAC.

---

From: Eric Burger <[email-masked]>
Date: Tue, 15 Dec 2015 20:28:22 -0500

The text explicitly states the entity copies the SIP date. Yes, anyone can lie - that is what crypto is for (so we know who lied, when). However, presuming entities that do not lie, why would they not do what JWT says to do?

> On Dec 15, 2015, at 12:55 PM, Peterson, Jon <[email-masked]> wrote:
> 
>