Subject: Re: [jose] Barry Leiba's No Objection on draft-ietf-jose-json-web-encryption-32: (with COMMENT)

From: Mike Jones <[email-masked]>
Date: Tue, 14 Oct 2014 12:40:38 +0000

These comments have been addressed in the -34 drafts.

                                                            Thanks again,
                                                            -- Mike

From: Mike Jones
Sent: Tuesday, September 30, 2014 11:51 AM
To: 'Barry Leiba'
Cc: The IESG; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: RE: Barry Leiba's No Objection on draft-ietf-jose-json-web-encryption-32: (with COMMENT)

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Barry Leiba
Sent: Tuesday, September 30, 2014 9:44 AM
To: Mike Jones
Cc: The IESG; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: Barry Leiba's No Objection on draft-ietf-jose-json-web-encryption-32: (with COMMENT)

>>    Finally, note that it is an application decision which algorithms are

>>    acceptable in a given context.  Even if a JWE can be successfully

>>    decrypted, unless the algorithms used in the JWE are acceptable to

>>    the application, it SHOULD reject the JWE.

>> It's a small point, but what does it mean for an algorithm to be

>> "acceptable", if not to define this very point?  That is, if I accept

>> (don't

>> reject) a decryption with algorithm X, doesn't that *mean* that

>> algorithm X is acceptable to me?

> Would you prefer that the first "are acceptable" be changed to "MAY be

> used"?  I believe that would remove any potential ambiguity.

I did say it was a small point...  Yes, with lowercase "may"

(definitely not 2119 "MAY"), I think that'd be slightly better, so thanks.

OK

> The intent is b.  I propose that the words "This member MUST be

> present, even if the array elements contain only the empty JSON object

> "{}"" be changed to "This member MUST be present with exactly one

> array element per recipient, even if some or all of the array element

> values are the empty JSON object {}".  Would that be clearer?

I think that would have helped me.  Again, another small point.

OK

> There's a reason that the introductory paragraph contains the caveat:

>    All these methods will yield the same result for all

>    legal input values; they may yield different results for malformed

>    inputs.

> I believe that this caveat covers the case of malformed (or at least

> confused) input that you're describing.  Therefore, I believe that no

> specific edit is needed to the specification in response to this comment.

Yes, that's fine; thanks for the answer.

Barry

                                                            Thanks again,

                                                            -- Mike

---

From: "Jim Schaad" <[email-masked]>
Date: Sat, 18 Oct 2014 11:24:46 -0700

From: jose [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Tuesday, October 14, 2014 5:41 AM
To: Barry Leiba
Cc: [email-masked];
[email-masked]; The IESG; [email-masked]
Subject: Re: [jose] Barry Leiba's No Objection on
draft-ietf-jose-json-web-encryption-32: (with COMMENT)

                                                            Thanks again,

                                                            -- Mike

From: Mike Jones 
Sent: Tuesday, September 30, 2014 11:51 AM
To: 'Barry Leiba'
Cc: The IESG; [email-masked];
[email-masked]; [email-masked]
Subject: RE: Barry Leiba's No Objection on
draft-ietf-jose-json-web-encryption-32: (with COMMENT)

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Barry
Leiba
Sent: Tuesday, September 30, 2014 9:44 AM
To: Mike Jones
Cc: The IESG; [email-masked];
[email-masked]; [email-masked]
Subject: Re: Barry Leiba's No Objection on
draft-ietf-jose-json-web-encryption-32: (with COMMENT)

OK

[JLS]  I think that this language may not be correct.  Did you mean to imply
that the following is a legal value for the "recipients" property.
"[{},{}]"

It appears that there can be any number of empty array elements can be
present.

If this is not the case I will try and look at proposing some text.

Barry

                                                            Thanks again,

                                                            -- Mike

---

From: Mike Jones <[email-masked]>
Date: Sat, 18 Oct 2014 22:27:33 +0000

> [JLS]  I think that this language may not be correct.  Did you mean to imply that the following is a legal value for the "recipients" property.  "[{},{}]"
> It appears that there can be any number of empty array elements can be present.
>

The full text about the recipients array at http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-35#section-7.2 is:

   recipients
      The "recipients" member value MUST be an array of JSON objects.
      Each object contains information specific to a single recipient.
      This member MUST be present with exactly one array element per
      recipient, even if some or all of the array element values are the
      empty JSON object "{}" (which can happen when all Header Parameter
      values are shared between all recipients and when no encrypted key
      is used, such as when doing Direct Encryption).

So it's not that any number of empty array elements can be present.  It's that exactly one JSON object must be present in the array per recipient, some of which may be empty because of the parameter choices made.

				-- Mike

---

From: "Jim Schaad" <[email-masked]>
Date: Sun, 19 Oct 2014 15:19:58 -0700

> From: Mike Jones [mailto:[email-masked]]
> Sent: Saturday, October 18, 2014 3:28 PM
> To: Jim Schaad; 'Barry Leiba'
> Cc: [email-masked]; jose-
> [email-masked]; 'The IESG'; [email-masked]
> Subject: RE: [jose] Barry Leiba's No Objection on
draft-ietf-jose-json-web-
> encryption-32: (with COMMENT)
> 
> > > present, even if the array elements contain only the empty JSON
> > > object "{}"" be changed to "This member MUST be present with exactly
> > > one array element per recipient, even if some or all of the array
> > > element values are the empty JSON object {}".  Would that be clearer?
> >
"[{},{}]"
> The full text about the recipients array at
http://tools.ietf.org/html/draft-
> ietf-jose-json-web-encryption-35#section-7.2 is:
> 
>    recipients
> So it's not that any number of empty array elements can be present.  It's
that
> exactly one JSON object must be present in the array per recipient, some
of
> which may be empty because of the parameter choices made.

This does not answer my question.  Is it a legal value?

Jim

---

From: Mike Jones <[email-masked]>
Date: Sun, 19 Oct 2014 22:25:49 +0000

> From: Jim Schaad [mailto:[email-masked]]
> Sent: Sunday, October 19, 2014 3:20 PM
> To: Mike Jones; 'Barry Leiba'
> Subject: RE: [jose] Barry Leiba's No Objection on draft-ietf-jose-json-web-
> > > > object "{}"" be changed to "This member MUST be present with
> > > > exactly one array element per recipient, even if some or all of
> > > > the array element values are the empty JSON object {}".  Would that be
> clearer?
> > >
> > > [JLS]  I think that this language may not be correct.  Did you mean
> > > to
> imply

[{},{}] is a legal value in the case that there are exactly two recipients, both of which have no per-recipient header parameter values or encrypted key values.

				-- Mike