Subject: [jose] API question re

From: <[email-masked]>
Date: Fri, 14 Sep 2012 14:57:23 +0200

Hi,

Some algorithms used in JOSE allow random data to be used.
Examples are IVs and CMKs.

My question: in an API for JOSE should I always generate all values that can be random randomly or should e.g. the IV be a parameter and I trust the developer using the API to provide secure and applicable values?

My current plan is to have a parameter "SecureRandom sr" in all public methods and generate all algorithm parameters randomly where that is possible.
So in an application server you can initialize the SecureRandom once and use it in all requests.

Thanks

Axel 

https://code.google.com/p/jsoncrypto/source/browse/trunk/src/org/jsoncrypto/JcBase.java

---

From: Mike Jones <[email-masked]>
Date: Fri, 14 Sep 2012 22:41:05 +0000

JWE conveys an IV parameter but is silent on who generates the random IV value.  An API that allows the creator of an encrypted object to request that a random IV be automatically generated by the library is probably fine.  Similarly, letting the library generate the random CMK is probably also fine.

				-- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Friday, September 14, 2012 5:57 AM
To: [email-masked]
Subject: [jose] API question re

Hi,

Thanks

Axel 

_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose