Subject: [jose] #49: Don't use RFC2119 language in the registry

From: "jose issue tracker" <[email-masked]>
Date: Thu, 01 Aug 2013 08:40:53 -0000

#49: Don't use RFC2119 language in the registry

 This issue comes from a discussion that I had with Pete Resnick during the
 F2F meeting.

 Having a column in the registry that indicates that there is an
 implementation level that is required is fine, however it should not use
 the 2119 requirements language directly.  It would be preferable to define
 a set of new terms (the string "must be implemented" would be fine) that
 give the set of levels of implementation.  This would also allow for a
 potential clean up of the +/- language as we could set a number of
 different expected values and then define how the 2119 language applies to
 those levels in the JWA document.  We should also provide a set of strong
 language about who is able to update the levels and what the process is to
 do so.  It is perfectly reasonable to have different processing for
 different levels. Per Stephen Farrell it would be nice if the process for
 updating the levels was similar to that of TLS for MTIs.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-jose-json-web-
  [email-masked] |  [email-masked]
     Type:  defect       |     Status:  new
 Priority:  major        |  Milestone:
Component:  json-web-    |    Version:
  algorithms             |   Keywords:
 Severity:  -            |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/49>
jose <http://tools.ietf.org/jose/>

---

From: Richard Barnes <[email-masked]>
Date: Thu, 1 Aug 2013 10:51:21 +0200

Thanks for raising this.  One of the issues in my queue was to clarify how
those requirements get managed.

One way to address this would be to move the implementation requirements
from the registry to the document.  Most algorithms are optional, so you
don't need to comment on them.  You would just have a section that
describes a core algorithm profile:

"""
X. Core Algorithms

In order to help ensure that implementations have common algorithms, this
document defines a core set of algorithms that MUST be supported.  This set
includes the following algorithms:
  - RS256
  - etc.
"""

Then when you want to update the requirements, you just write another RFC
that updates this one.

--Richard

On Thu, Aug 1, 2013 at 10:40 AM, jose issue tracker <
[email-masked]> wrote:

> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>