Subject: [jose] MUST understand ALL header fields

From: "Manger, James H" <[email-masked]>
Date: Wed, 16 May 2012 00:55:33 +1000

draft-ietf-jose-json-web-signature-02 and draft-ietf-jose-json-web-encryption-02 say:

   Implementations MUST understand the entire contents of the
   header; otherwise, the {JWS|JWE} MUST be rejected.

We should drop this restriction.

Firstly, most implementations will ignore it.
I had a quick glance at some existing implementations (magical/jwt-python, markrcote/jwt, jsontoken) and all appear to ignore this requirement.
It cannot add any security when it is ignored. It does cause massive compatibility headaches for anyone wanting to define another header parameter, since a new parameter will break some implementations.

Secondly, a couple of parameters are defined for X.509 certs, but none for OCSP responses, CRLs, timestamps etc. It is inevitable that a cert-based scheme will need these extra pieces of info. With the "MUST understand everything" rule, we have to define all the extra info that might be needed right now.

If we need to be able to break backward compatibility we should define a mechanism explicitly for that.

--
James Manger