Subject: [jose] JWS Appendix D. Notes on Key Selection

From: Mike Jones <[email-masked]>
Date: Sat, 18 Jan 2014 20:10:36 +0000

This updated text for JWS Appendix D is intended to address Jim's comments from yesterday.

                                                            -- Mike

Appendix D.  Notes on Key Selection

This appendix describes a set of possible algorithms for selecting the key to be used to validate the digital signature or MAC of a JWS object or for selecting the key to be used to decrypt a JWE object. This guidance describes a family of possible algorithms, rather than a single algorithm, because in different contexts, not all the sources of keys will be used, they can be tried in different orders, and sometimes not all the collected keys will be tried; hence, different algorithms will be used in different application contexts.

These algorithms use some or all of the steps described below; the order and inclusion of the steps does not mean that they need to be performed in this order or that they are required in all contexts. The steps below are described for illustration purposes only; specific applications can and are likely to use different algorithms. Specific applications will frequently have a much simpler method of determining the keys to use, as there may be one or two key selection methods that are profiled for the application's use. This appendix supplements the normative information on key location in Section 6 (Key Identification).

Algorithm steps may include:
1.   Collect a set of potentially applicable keys. Sources of keys may include:
o   Keys supplied by the application protocol being used.
o   Keys referenced by the jku (JWK Set URL) Header Parameter.
o   The key provided by the jwk (JSON Web Key) Header Parameter.
o   Keys referenced by the x5u (X.509 URL) Header Parameter.
o   The key provided by the x5c (X.509 Certificate Chain) Header Parameter.
o   Other applicable keys available to the application.
2.   Order the set of collected keys. For instance, keys referenced by kid (Key ID) or x5t (X.509 Certificate SHA-1 Thumbprint) parameters might be tried before other keys. Likewise, keys with certain kty (Key Type) values, alg (Algorithm) values, or other member values might be ordered before keys with other kty values, alg values, or other member values.
3.   Filter the set of collected keys. For instance, only keys referenced by kid (Key ID) or x5t (X.509 Certificate SHA-1 Thumbprint) parameters might be tried by the application. Keys with an invalid certificate chain would typically be excluded. Likewise, keys might be filtered to include or exclude keys with certain kty (Key Type) values, alg (Algorithm) values, use (Key Use) values, key_ops (Key Operations) values, or other member values. A limit on the number of keys to be tried might also be applied.
4.   Attempt signature or MAC validation for a JWS object or decryption of a JWE object with some or all of the collected and possibly ordered and/or filtered keys. This process will normally terminate following a successful validation or decryption.

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 20 Jan 2014 11:16:42 -0800

It is a start but not all comments were addressed.

You need to try reading what you are writing with an eye that is looking for
things that can easily be mis-interpreted.

From: jose [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Saturday, January 18, 2014 12:11 PM
To: [email-masked]
Subject: [jose] JWS Appendix D. Notes on Key Selection

This updated text for JWS Appendix D is intended to address Jim's comments
from yesterday.

                                                            -- Mike

This appendix describes a set of possible algorithms for selecting the key
to be used to validate the digital signature or MAC of a JWS object or for
selecting the key to be used to decrypt a JWE object. This guidance
describes a family of possible algorithms, rather than a single algorithm,
because in different contexts, not all the sources of keys will be used,
they can be tried in different orders, and sometimes not all the collected
keys will be tried; hence, different algorithms will be used in different
application contexts. 

These algorithms use some or all of the steps described below; the order and
inclusion of the steps does not mean that they need to be performed in this
order or that they are required in all contexts. The steps below are
described for illustration purposes only; specific applications can and are
likely to use different algorithms. Specific applications will frequently
have a much simpler method of determining the keys to use, as there may be
one or two key selection methods that are profiled for the application's
use. This appendix supplements the normative information on key location in
Section 6 (Key Identification). 

Great - so I'll just skip steps 1 and 4.

1.   Collect a set of potentially applicable keys. Sources of keys may
include: 

2.   Order the set of collected keys. For instance, keys referenced by kid
(Key ID) or x5t (X.509 Certificate SHA-1 Thumbprint) parameters might be
tried before other keys. Likewise, keys with certain kty (Key Type) values,
alg (Algorithm) values, or other member values might be ordered before keys
with other kty values, alg values, or other member values. 

3.   Filter the set of collected keys. For instance, only keys referenced by
kid (Key ID) or x5t (X.509 Certificate SHA-1 Thumbprint) parameters might be
tried by the application. Keys with an invalid certificate chain would
typically be excluded. Likewise, keys might be filtered to include or
exclude keys with certain kty (Key Type) values, alg (Algorithm) values, use
(Key Use) values, key_ops (Key Operations) values, or other member values. A
limit on the number of keys to be tried might also be applied. 

4.   Attempt signature or MAC validation for a JWS object or decryption of a
JWE object with some or all of the collected and possibly ordered and/or
filtered keys. This process will normally terminate following a successful
validation or decryption.

---

From: Mike Jones <[email-masked]>
Date: Mon, 20 Jan 2014 19:28:49 +0000

I can change "the order and inclusion of the steps does not mean that they need to be performed in this order or that they are required in all contexts" to "the order and inclusion of the steps does not mean that they need to be performed in this order or that they are all required in all contexts.  In particular, sorting and filtering sometimes will be unnecessary."  Does that address the potential misinterpretation you're calling out or would you like to suggest a different way of handling it?

From: jose [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Monday, January 20, 2014 11:17 AM
To: Mike Jones; [email-masked]
Subject: Re: [jose] JWS Appendix D. Notes on Key Selection

You need to try reading what you are writing with an eye that is looking for things that can easily be mis-interpreted.

From: jose [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Saturday, January 18, 2014 12:11 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [jose] JWS Appendix D. Notes on Key Selection

                                                            -- Mike

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 20 Jan 2014 12:23:23 -0800

As near as I can tell, the only step that is optional in anyway is the
sorting step based on my first set of comments.  And one could say that you
might use an non-sort sort in this case.

Also - you still need to look at the original message to find the things you
omitted.

From: Mike Jones [mailto:[email-masked]] 
Sent: Monday, January 20, 2014 11:29 AM
To: Jim Schaad; [email-masked]
Subject: RE: [jose] JWS Appendix D. Notes on Key Selection

I can change "the order and inclusion of the steps does not mean that they
need to be performed in this order or that they are required in all
contexts" to "the order and inclusion of the steps does not mean that they
need to be performed in this order or that they are all required in all
contexts.  In particular, sorting and filtering sometimes will be
unnecessary."  Does that address the potential misinterpretation you're
calling out or would you like to suggest a different way of handling it?

                                                            -- Mike

---

From: Mike Jones <[email-masked]>
Date: Mon, 20 Jan 2014 20:36:08 +0000

You don't have to filter if you just try all the keys, which is reasonable if the number of keys is small, which it typically is.

You've sent a number of messages on this topic.  Which one are you referring to as "the original message"?

                                                            -- Mike

From: jose [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Monday, January 20, 2014 12:23 PM
To: Mike Jones; [email-masked]
Subject: Re: [jose] JWS Appendix D. Notes on Key Selection

As near as I can tell, the only step that is optional in anyway is the sorting step based on my first set of comments.  And one could say that you might use an non-sort sort in this case.

Also - you still need to look at the original message to find the things you omitted.

From: Mike Jones [mailto:[email-masked]]
Sent: Monday, January 20, 2014 11:29 AM
To: Jim Schaad; [email-masked]<mailto:[email-masked]>
Subject: RE: [jose] JWS Appendix D. Notes on Key Selection

From: jose [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Monday, January 20, 2014 11:17 AM
To: Mike Jones; [email-masked]<mailto:[email-masked]>
Subject: Re: [jose] JWS Appendix D. Notes on Key Selection

                                                            -- Mike

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 20 Jan 2014 13:08:25 -0800

You need to filter based on use, kty, alg.  Would you consider it a success
to validate a signature with an RSA key that has "use":"enc"?

Restrict your self to this thead.

From: Mike Jones [mailto:[email-masked]] 
Sent: Monday, January 20, 2014 12:36 PM
To: Jim Schaad; [email-masked]
Subject: RE: [jose] JWS Appendix D. Notes on Key Selection

You don't have to filter if you just try all the keys, which is reasonable
if the number of keys is small, which it typically is.

You've sent a number of messages on this topic.  Which one are you referring
to as "the original message"?

                                                            -- Mike

                                                            -- Mike

---

From: Mike Jones <[email-masked]>
Date: Tue, 21 Jan 2014 07:29:45 +0000

I went back to the original message for issue #93 and I applied all the omissions I identified.  Thanks for helping to make the appendix as useful as possible.

                                                            -- Mike

From: jose [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Monday, January 20, 2014 1:08 PM
To: Mike Jones; [email-masked]
Subject: Re: [jose] JWS Appendix D. Notes on Key Selection

You need to filter based on use, kty, alg.  Would you consider it a success to validate a signature with an RSA key that has "use":"enc"?

                                                            -- Mike

                                                            -- Mike