Session Date/Time: 23 Jul 2025 12:30

STIR Working Group Meeting - IETF 123

Summary

The STIR working group met to discuss three main topics: Certificate Transparency for STIR certificates, JWT Claim Constraints for ACME, and the Vesper framework. The group also addressed administrative updates including document status and a reference update for RFC 8588. Key discussions focused on the applicability and threat model for certificate transparency in the STIR context, and progress on the Vesper framework simplification.

Key Discussion Points

Document Status Updates

RFC 9795 on RCD is now published
Two documents currently with IESG: one approved and waiting for final actions, RFC 4916 update pending author actions
Certificate OCSP document in IETF last call
Certificate short-lived document completed working group last call, awaiting shepherd write-up

Certificate Transparency for STIR

Threat Model Discussion: Extensive debate on the specific threats CT addresses in STIR context vs. WebPKI
- Missisuance of SPC codes in certificates
- Incorrect telephone number validation by CAs
- Rogue CA certificate issuance
Competition Concerns: Discussion about potential for CT policies to favor certain classes of entities over others in pluralist environments
Technical Benefits:
- Detection of certificates issued with unauthorized service provider codes
- Monitoring capability for legitimate certificate holders
- Forensic value for investigating certificate misuse
Implementation Details: Focus on profiling RFC 6962 for STIR context rather than redefining CT mechanisms

JWT Claim Constraints in ACME

Informational Update: Progress on ACME draft for authority token profiles
Technical Approach: Two certificate extensions defined in RFC 8226, creating authority token profile for potential RCD and delegate certificate usage
Examples Provided: Basic RCD usage patterns with permitted and excluded claim values
Status: Moving toward adoption in ACME working group with positive feedback

Vesper Framework

Major Simplification: Wholesale revision based on IETF 122 feedback to focus on current STIR tools and scope
Scope Definition: Limited to delegate certificates with telephone number scope, TN and JWT claim constraints usage
Architecture: Framework for authority token management, number assignment validation, and KYC/vetting processes
Privacy Features: Hash mechanisms to protect sensitive data while maintaining integrity verification
Modularity: Suggestion to make certificate transparency support more modular rather than tightly coupled

RFC 8588 Reference Update

Issue: Referenced ATIS specification version no longer available due to ATIS versioning practices
Solution: Update to persistent reference for current v3 version, potentially hosted by SIP Forum
Process: New draft submitted to address reference issues and incorporate incremental updates

Decisions and Action Items

Certificate Transparency: No formal objection to call for adoption - proceeding with adoption process
Vesper Framework: Not calling for adoption yet, seeking additional feedback round before proceeding
RFC 8588 Update: Chris Wendt to initiate mailing list discussion on the reference update draft
ACME JWT Constraints: Continue progress in ACME working group with STIR awareness

Next Steps

Issue call for adoption on Certificate Transparency draft
Solicit additional feedback on Vesper framework before adoption consideration
Begin mailing list discussion on RFC 8588 reference update
Continue ACME working group process for JWT claim constraints
Incorporate feedback on certificate transparency modularity suggestions for Vesper