Subject: Re: [jose] Comments on draft-ietf-jose-json-web-algorithms-02

From: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Date: Tue, 22 May 2012 00:53:09 -0700

>> Section 3.1
>>
>> 1. I am not overly happy with the existence of a "none" algorithm. Does it
>> really need to exist?
> 
> +1 for removing "none"

+1 for deprecating none.

The same information can be expressed by simply omitting "alg". This
makes plain JWTs nimbler too. I see no problem with having empty headers
for plain JWTs.

Also, by removing "none", "alg" would become consistent with the rest of
the parameters which don't have "none" values (we don't have
"enc":"none", etc.). Very much like the recent change to "zip" (JWS,
section 4.1.6) which no longer has the (optional) "none": it's either
"zip":"DEF" or nothing.

Vladimir
--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]

---

From: Sean Turner <[email-masked]>
Date: Sun, 27 May 2012 21:18:30 -0400

> section 4.1.6) which no longer has the (optional) "none": it's either

Just make sure to explain what it means when alg is omitted.  Assume 
this would apply equally to both JSW and JWE?

spt