Subject: Re: [jose] draft-manger-jose-jwsec

From: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Date: Mon, 18 Jun 2012 01:24:19 -0700

Hi Jim,

Signature verification should obviously fail.

Our Nimbus-JWT library has an enum of all supported algs and their type
(JWS/JWE), so this error is detected fairly early in the process.

I was however wondering about James' use case for having the prefix - to
allow routers and firewalls to inspect the security of the message. I
now realise that this method is rather limited, as the message may still
be invalid. But then, I don't know what inspection depth he seeks to
have.

Vladimir

--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]

-------- Original Message --------
Subject: RE: [jose] draft-manger-jose-jwsec
From: "Jim Schaad" <[email-masked]>
Date: Mon, June 18, 2012 4:17 am
To: "'Vladimir Dzhuvinov / NimbusDS'" <[email-masked]>,
"'Manger, James H'" <[email-masked]>
Cc: <[email-masked]>

<no hat>

I think that this question may be of relevance for the current
specification
as well. What happens if I put an encryption algorithm in the alg field
but
do signature processing?

Jim

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Vladimir Dzhuvinov / NimbusDS
> Sent: Wednesday, June 13, 2012 12:02 AM
> To: Manger, James H
> Cc: [email-masked]
> Subject: Re: [jose] draft-manger-jose-jwsec
> 
> Hi James,
> 
> What should happen when there is a mismatch between the "S"/"E"/...
> prefix and the actual type of the applied algorithm?
> 
> 
> Cheers,
> 
> Vladimir
> 
> --
> Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]
> 
> 
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose