Subject: Re: [jose] draft-manger-jose-jwsec: IV ciphertext tag

From: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Date: Mon, 18 Jun 2012 01:00:10 -0700

Cheers, this is very good news to us! Right now, if an JavaScript app
need to do JWT verification in the browser it has to load a whole bunch
of maths + crypto lib code, and this obviously cannot run at native
speed. 

I hope they'll do a good job!

Vladimir

--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]

-------- Original Message --------
Subject: Re: [jose] draft-manger-jose-jwsec: IV ciphertext tag
From: "HAYASHI, Tatsuya" <[email-masked]>
Date: Sat, June 16, 2012 7:11 pm
To: "Manger, James H" <[email-masked]>, [email-masked]
Cc: Dick Hardt <[email-masked]>

FYI:

W3C (and IETF?) are doing relevant work now.
 http://www.w3.org/2012/webcrypto/
 (based on Mozilla DOMCrypt)

(sorry if wrong.)

-- 
Tatsuya

On Tue, Jun 12, 2012 at 1:53 PM, Dick Hardt <[email-masked]>
wrote:
>
> On Jun 11, 2012, at 9:05 PM, Manger, James H wrote:
>
> 6. The initialization vector (IV) and authentication tag associated
>
> with an AEAD algorithm are prepended, and appended to the ciphertext
>
>
> I'm writing in JavaScript. The UTF-8 parsing is a non-issue for me. :)
>
> Splitting a byte array can be done, but is not as straightforward. :(
>
>
> You can easily concatenate the data together for your implementation. I
> looked at a few JS > crypto libraries and they had different parameter
> passing mechanisms.
>
>
> Could you share a few links to JavaScript Crypto APIs.
>
>
> These are battle tested libraries:
>
> http://code.google.com/p/crypto-js/
> http://nodejs.org/api/crypto.html
>
>
> Dick (and other implementers),
> It sounds like you have written a JavaScript JOSE library. Does it implement
> AES GCM? Does it check the IV and authentication tag lengths? (and no
> cheating by adding the checks before answering ;-)
>
>
> I have not yet had to implement JWE, only JWS so far. I am currently
> specifying JWE for a major project (and hope the spec settles!)
>
> FYI: I recall seeing a few implementations in JS on GitHub. I know the
> Mozilla guys built a JS library for node.js for their BrowserID project.
>
> -- Dick
>
>
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>

-- 
HAYASHI, Tatsuya
Lepidum Co. Ltd.
_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose