Subject: Re: [jose] Stephen Farrell's Discuss on draft-ietf-jose-json-web-key-33: (with DISCUSS and COMMENT)

From: Mike Jones <[email-masked]>
Date: Tue, 14 Oct 2014 12:52:16 +0000

A slight wording change from “recipients” to “parsers” to clarify the intent has been made in the -34 drafts as a result of Pete Resnick’s comments on the JWK draft.  Otherwise, this language as been left as-is.

                                                            -- Mike

From: Mike Jones [mailto:[email-masked]]
Sent: Monday, October 06, 2014 12:54 AM
To: Kathleen Moriarty; Stephen Farrell
Cc: The IESG; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: RE: Stephen Farrell's Discuss on draft-ietf-jose-json-web-key-33: (with DISCUSS and COMMENT)

[Adding the working group to this thread so they’re aware of the discussion between our Security Area Directors on this]

From: Kathleen Moriarty [mailto:[email-masked]]
Sent: Thursday, October 02, 2014 5:30 AM
To: Stephen Farrell
Cc: The IESG; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: Stephen Farrell's Discuss on draft-ietf-jose-json-web-key-33: (with DISCUSS and COMMENT)

On Thu, Oct 2, 2014 at 8:20 AM, Stephen Farrell <[email-masked]<mailto:[email-masked]>> wrote:

sorry forgot about that...

On 02/10/14 13:04, Kathleen Moriarty wrote:
> Yes, I mentioned the duplicate member name discussion in a couple of
> the draft's ballot text.  There isn't really a great answer at this
> time unfortunately.  This particular item came up in my AD review as
> well as in a SecDir review.  It took some digging, but the problem is
> at least better understood now.  There may be a way to fix it with a
> draft that updates if I-JSON turns out to be a good way to handle
> this.  The problem is deployed code.  I flagged it in case anyone in
> the IESG had an opinion.  I'd love to see the right thing get done,
> but it may have to wait for a draft that updates these.  Opinions are
> welcome.

At a comment level, I'd say leave things as they are. Adding the
I-JSON requirement would be premature I think as its not clear if
libraries etc will or won't adopt that. If they don't then it'd
be a meaningless requirement. If however, I-JSON does take off then
JOSE code will be fine anyway without changing.

Thanks, Stephen.  I'm leaning the same way for now.  It looks like Pete hit this in a discuss, but just requesting a wording change as opposed the the more extensive changes discussed on list.  I'll follow up to his message.

S.

--

Best regards,
Kathleen

---

From: Mike Jones <[email-masked]>
Date: Tue, 14 Oct 2014 12:53:19 +0000

The proposed resolutions below have been incorporated in the -34 draft.  The actual text addressing the "kid" string comparison issue is in an expanded JWS Section 5.3.  Hopefully you can clear your DISCUSS on that basis.

"makes sense" in the designated expert instructions was changed to "description is clear" in all drafts.

				Thanks again,
				-- Mike

> -----Original Message-----
> From: jose [mailto:[email-masked]] On Behalf Of Mike Jones
> To: Stephen Farrell; The IESG
> Cc: [email-masked]; [email-masked];
> [email-masked]
> Subject: Re: [jose] Stephen Farrell's Discuss on draft-ietf-jose-json-web-key-33:
> (with DISCUSS and COMMENT)
> 
> Thanks for your review, Stephen.  I'm adding the working group to the thread so
> they're aware of your comments.
> 
> > -----Original Message-----
> > From: Stephen Farrell [mailto:[email-masked]]
> > Sent: Thursday, October 02, 2014 4:15 AM
> > To: The IESG
> > Cc: [email-masked];
> > [email-masked]
> > Subject: Stephen Farrell's Discuss on draft-ietf-jose-json-web-key-33:
> > (with DISCUSS and COMMENT)
> >
> > Stephen Farrell has entered the following ballot position for
> > draft-ietf-jose-json-web-key-33: Discuss
> >
> > When responding, please keep the subject line intact and reply to all
> > email addresses included in the To and CC lines. (Feel free to cut
> > this introductory paragraph, however.)
> >
> >
> > Please refer to
> > http://www.ietf.org/iesg/statement/discuss-criteria.html
> > for more information about IESG DISCUSS and COMMENT positions.
> >
> >
> > The document, along with other ballot positions, can be found here:
> > http://datatracker.ietf.org/doc/draft-ietf-jose-json-web-key/
> >
> >
> >
> > ----------------------------------------------------------------------
> > DISCUSS:
> > ----------------------------------------------------------------------
> >
> >
> > nearly a nit, but would impact code so a discuss to make sure we get it right...
> >
> > 4.5: saying kid is case sensitive precludes use of DNS names there or
> > introduces bugs if those are used.  Since DNS names are the primary
> > way we distinguish things on the Internet, that seems odd. I don't
> > think that you need to say case- insensitive here but that you might
> > want to say that DNS names SHOULD be [lower|upper]cased before being
> used in kid parameters.
> 
> OK
> 
> > ----------------------------------------------------------------------
> > COMMENT:
> > ----------------------------------------------------------------------
> >
> >
> > 4.8: I'd prefer if sha-256 had been the default/shorter of these. But whatever.
> 
> The SHA-1 is the one that's actually in widely deployed crypto libraries, including
> Windows and OpenSSL, and has been in the spec pretty much the whole time.
> Kathleen had us add the S256 version based on its usage in SSH during her AD
> review.
> 
> > 4.8/4.9: the disconnect with DANE and other specs that use
> > HASH(SPKI) as a thumbprint is a pity (but can be fixed later). How'd that
> happen?
> 
> The current thumbprint calculation is the one used by OpenSSL and Windows,
> among others.
> 
> The first that this issue was raised was during Tero Kivinen's secdir review.  In
> that discussion, I pointed out that other specs are free to define header
> parameter(s) to represent the HASH(SPKI) thumbprint and register them.  (I even
> pointed him to draft-jones-jose-jwk-thumbprint-01 as an example of a spec
> making a similar registration that he could use as an example if he wanted to
> write it up.)  He thought that that definition would be useful to the IoT
> community, so I expect that someone will do that when the need arises.
> 
> > 8: "make sense" still isn't useful;-) I've noted that on the algs
> > draft though so won't repeat more.
> 
> Noted
> 
> > C.9: Huh? Needs a ref to compact rep which isn't defined here.
> 
> Agreed - thanks
> 
> > As with other JOSE drafts, there was a substantial thread on the
> > secdir review that I didn't have time to follow but I'm ok that Kathleen's been
> on top of that.
> 
> Yes, she has.
> 
> 				Thanks again,
> 				-- Mike
> 
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose