Subject: [COSE] questionable header parameters (was Re: draft -04 published)

From: Brian Campbell <[email-masked]>
Date: Mon, 31 Aug 2015 13:46:32 -0600

Hi Ilari,

I'm working to get to some consensus on some of these headers. There's a
short thread on it:
http://www.ietf.org/mail-archive/web/cose/current/msg00459.html - I'll take
your comments here into account but feel free to jump in on that thread as
well.

I expect the URL-type things like jku (or cku) and x5u to go away in future
drafts.

Some desire for X509 support in headers has been expressed. The jury is
still out on these, I think.

I don't believe the jwk header is being used much, if at all, in JOSE. Jim
has expressed "an, admittedly small, degree of sympathy for allowing the
key to be carried in the message." I do have some sympathy for that
sympathy but would personally prefer to get rid of a jwk equivalent header
for COSE.

I do need to bring up zip for discussion. But agree with your assessment.

On Sat, Aug 29, 2015 at 12:22 PM, Jim Schaad <[email-masked]> wrote:

>
>
> > -----Original Message-----
> > From: Ilari Liusvaara [mailto:[email-masked]]
> > Sent: Saturday, August 29, 2015 12:17 AM
> > Subject: Re: [COSE] draft -04 published
>
> > 3) Regarding questionable header parameters:
> >    - URL-type things: jku and x5u... URL retretival has nontrivial
> >      security concerns.
> >    - X509-type things: x5c, x5t, x5t#SHA256, x5u: These assume X.509,
> >      which is complicated to the point that even full-powered systems
> >      have problems implementing it.
> >    - jwk: Apparently this header is used with JOSE, so I would imagine
> >      equivalent usecases do apply here too.
> >    - zip: Constrained systems probably don't appreciate compression,
> >      but it could be nice in full-powered systems.
>
> Brian is currently working on these issues and should respond.
>