Subject: Re: [COSE] RSA Algorithm Decisions

From: Brian Campbell <[email-masked]>
Date: Mon, 3 Aug 2015 15:19:12 -0600

I'm not sure what you mean that there is no legacy that needs to be
supported for COSE?

Short of implementing algorithms from scratch, which I expect to be very
rare, COSE implementations will be constrained in their algorithm support
by what is available from the the underlying platform or easily accessible
libraries.

>From what I've seen, RSASSA-PKCS1-v1_5 is still the most commonly available
and most widely used RSA based signature mechanism.  If RSA is being
included for completeness, RSASSA-PKCS1-v1_5 should also be included.

A default installation of Java, for example, doesn't have RSASSA-PSS
support. Google's whole federated identity system, as another example, only
supports JWS's RS256 to sign its JWT is tokens.

On Thu, Jul 30, 2015 at 4:32 PM, Jim Schaad <[email-masked]> wrote:

> I am currently in the process of updating/expanding the text for RSA.  This
> message is what I am using the control the decision process.
>
> *  The world of IoT is not interested (or so close to not interested) in
> using RSA that it could be ignored from that point of view.  Therefore RSA
> is being included as for completeness as anything else.   There may be some
> other items that port over and use RSA, but it is expected that most are
> going to use EC instead.
>
> *  There is no legacy that needs to be supported for COSE.   This means
> that
> there is no pressing need to support any of the RSA v1.5 algorithms.  Any
> code that needs to have RSA can use the "modern" versions.
>
> *  We do want to support both public keys and private keys in the COSE key
> structure.
>
> *  There is sufficient reason to support all three if the "standard" SHA-2
> hash algorithms with all of the RSA algorithms.  This means that PSS and
> OAEP for SHA-256, SHA-384 and SHA-512.
>
> *  As IoT does not have an interest in these algorithms, there is no reason
> to waste precious one byte algorithm identifiers on them.  They will get
> two
> byte algorithm identifiers.
>
> If anyone has problems with this, please let me know.
>
> Jim
>
>
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose
>

---

From: Brian Campbell <[email-masked]>
Date: Mon, 3 Aug 2015 16:25:34 -0600

"is tokens" should say "id tokens"

On Mon, Aug 3, 2015 at 3:19 PM, Brian Campbell <[email-masked]>
wrote:

> From what I've seen, RSASSA-PKCS1-v1_5 is still the most commonly
> available and most widely used RSA based signature mechanism.  If RSA is
> being included for completeness, RSASSA-PKCS1-v1_5 should also be included.
>

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 3 Aug 2015 17:00:22 -0700

When I said there is no legacy, I was referring to the fact that there is currently no code base that is using COSE as a message format.  This is different than JOSE where, as you point out, there is a large amount of RSA v1.5 that was being used even before the JOSE specifications were really finalized.

There is an interesting question of where COSE is going to be used.  For the constrained world, I would think that we could eliminated RSA and they would just yawn for the most part.  So there are two questions:  Where outside of constrained environments is COSE going to be used?  How badly do we feel about the security problems with RSA v1.5?

I don’t know the answer to the first question.  

On the second question I have opinions.  RSA has opinions and the IAB/IESG has opinions.

>From PKCS#1 dated Feb 2003

   Two encryption schemes are specified in this document: RSAES-OAEP and

   RSAES-PKCS1-v1_5.  RSAES-OAEP is recommended for new applications;

   RSAES-PKCS1-v1_5 is included only for compatibility with existing

   applications, and is not recommended for new applications.

I think that I have seen similar language coming from the Sec Area Directorate, the IESG and IAB (although perhaps as individuals).   

This is an opinion that I share.  There are too many different ways to get attacks on PKCS #1 v1.5 to keep it as a primary system.   I would prefer to make people install up-to-date security systems that to continue using the old algorithms.  This means that I don’t really worry about the fact that it is not supported in all environments.  We are not currently supporting DH or DSA either, we are assuming that people are going to be able to support the EC versions of those algorithms.  The statement above is far enough ago in the past that we should be willing to accept it and move forward.

I would be perfectly willing to deprecate all of RSA, the only question is do we need to keep it for some type of fail over point.

jim

From: Brian Campbell [mailto:[email-masked]] 
Sent: Monday, August 03, 2015 3:26 PM
To: Jim Schaad
Cc: [email-masked]
Subject: Re: [COSE] RSA Algorithm Decisions

On Mon, Aug 3, 2015 at 3:19 PM, Brian Campbell <[email-masked] <mailto:[email-masked]> > wrote:

I'm not sure what you mean that there is no legacy that needs to be supported for COSE? 

Short of implementing algorithms from scratch, which I expect to be very rare, COSE implementations will be constrained in their algorithm support by what is available from the the underlying platform or easily accessible libraries. 

>From what I've seen, RSASSA-PKCS1-v1_5 is still the most commonly available and most widely used RSA based signature mechanism.  If RSA is being included for completeness, RSASSA-PKCS1-v1_5 should also be included.

A default installation of Java, for example, doesn't have RSASSA-PSS support. Google's whole federated identity system, as another example, only supports JWS's RS256 to sign its JWT is tokens.

 

On Thu, Jul 30, 2015 at 4:32 PM, Jim Schaad <[email-masked] <mailto:[email-masked]> > wrote:

*  There is no legacy that needs to be supported for COSE.   This means that
there is no pressing need to support any of the RSA v1.5 algorithms.  Any
code that needs to have RSA can use the "modern" versions.

*  As IoT does not have an interest in these algorithms, there is no reason
to waste precious one byte algorithm identifiers on them.  They will get two
byte algorithm identifiers.

Jim

_______________________________________________
COSE mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/cose

---

From: Brian Campbell <[email-masked]>
Date: Tue, 4 Aug 2015 07:21:03 -0600

The suggestion was that RSASSA-PKCS1-v1_5 be included as a signature
scheme, not for RSAES-PKCS1-v1_5 as an encryption scheme. The latter has
known issues and support for the recommended alternative of RSAES-OAEP is
fairly widespread. On the former, according to PKCS#1 V2.2, dated Oct 2012,
"no attacks are known against RSASSA-PKCS1-v1_5". And support for the
alternative RSASSA-PSS isn't particularly extensive.

And you've misconstrued what I was trying say about JOSE and
RSASSA-PKCS1-v1_5. I was suggesting that Google (a decent sized company
with some resources at its disposal and services used by a few people)
choosing RS256 as the only JWS algorithm they use to sign ID tokens says
something about the usage, availability and security of the RSA based
signature schemes in the real world deployments.

On Mon, Aug 3, 2015 at 6:00 PM, Jim Schaad <[email-masked]> wrote:

> When I said there is no legacy, I was referring to the fact that there is
> currently no code base that is using COSE as a message format.  This is
> different than JOSE where, as you point out, there is a large amount of RSA
> v1.5 that was being used even before the JOSE specifications were really
> finalized.
>
>
>
> There is an interesting question of where COSE is going to be used.  For
> the constrained world, I would think that we could eliminated RSA and they
> would just yawn for the most part.  So there are two questions:  Where
> outside of constrained environments is COSE going to be used?  How badly do
> we feel about the security problems with RSA v1.5?
>
>
>
> I think that I have seen similar language coming from the Sec Area
> Directorate, the IESG and IAB (although perhaps as individuals).
>
>
>
> This is an opinion that I share.  There are too many different ways to get
> attacks on PKCS #1 v1.5 to keep it as a primary system.   I would prefer to
> make people install up-to-date security systems that to continue using the
> old algorithms.  This means that I don’t really worry about the fact that
> it is not supported in all environments.  We are not currently supporting
> DH or DSA either, we are assuming that people are going to be able to
> support the EC versions of those algorithms.  The statement above is far
> enough ago in the past that we should be willing to accept it and move
> forward.
>
>
>
> I would be perfectly willing to deprecate all of RSA, the only question is
> do we need to keep it for some type of fail over point.
>
>
>
> jim
>
>
>
> *From:* Brian Campbell [mailto:[email-masked]]
> *Sent:* Monday, August 03, 2015 3:26 PM
> *To:* Jim Schaad
> *Cc:* [email-masked]
> *Subject:* Re: [COSE] RSA Algorithm Decisions
>
>
>

---

From: "Jim Schaad" <[email-masked]>
Date: Wed, 5 Aug 2015 12:16:42 -0700

First, let’s get the full quote from PKCS#1 V2.2 instead of just the partial quote that you included.

Although no attacks are known against RSASSA-PKCS1-v1_5, in the interest of increased robustness, RSASSA-PSS is required in new applications. RSASSA-PKCS1-v1_5 is included only for compatibility with existing applications.

I would agree that there is an issue with deployment of PSS signatures, however there exists lots of code that implements it.  It has not been deployed widely because people are not using it widely.  However there are many cases where it is going to start being required.  For example, TLS is moving towards only accepting PSS in v1.3.  

I believe that we qualify as a “new application” and therefore we should be following the advice from RSA even if it may not popular with people doing deployments immediately.   I still would not expect any constrained deployments to be using RSA, so it will be interesting to see who picks this up and if they find it to be a problem.  I would not, for example, be expecting that this is going to take over the world of JWT (and this is one way which might slow down any such process).  However, I must admit that the fact they are using RSA rather than ECDSA to be disturbing due to the size issues for some browsers. (Although not, as I understand it, an issue for chrome.)

Jim

From: Brian Campbell [mailto:[email-masked]] 
Sent: Tuesday, August 04, 2015 6:21 AM
To: Jim Schaad
Cc: [email-masked]
Subject: Re: [COSE] RSA Algorithm Decisions

The suggestion was that RSASSA-PKCS1-v1_5 be included as a signature scheme, not for RSAES-PKCS1-v1_5 as an encryption scheme. The latter has known issues and support for the recommended alternative of RSAES-OAEP is fairly widespread. On the former, according to PKCS#1 V2.2, dated Oct 2012, "no attacks are known against RSASSA-PKCS1-v1_5". And support for the alternative RSASSA-PSS isn't particularly extensive. 

And you've misconstrued what I was trying say about JOSE and RSASSA-PKCS1-v1_5. I was suggesting that Google (a decent sized company with some resources at its disposal and services used by a few people) choosing RS256 as the only JWS algorithm they use to sign ID tokens says something about the usage, availability and security of the RSA based signature schemes in the real world deployments.  

On Mon, Aug 3, 2015 at 6:00 PM, Jim Schaad <[email-masked] <mailto:[email-masked]> > wrote:

jim

From: Brian Campbell [mailto:[email-masked] <mailto:[email-masked]> ] 
Sent: Monday, August 03, 2015 3:26 PM
To: Jim Schaad
Cc: [email-masked] <mailto:[email-masked]> 
Subject: Re: [COSE] RSA Algorithm Decisions

 

Jim

---

From: Brian Campbell <[email-masked]>
Date: Mon, 10 Aug 2015 11:14:53 -0600

Yeah, I'm aware of the full text there. I quoted only the absence of known
attacks on RSASSA-PKCS1-v1_5 because that seemed to be your main concern
with RSAES-PKCS1-v1_5 (though a bit of a detour because I wasn't suggesting
that one). I think compatibility with support in existing platforms and
libraries is sufficient reason to include RSASSA-PKCS1-v1_5 and that
omitting it would be a mistake that ignores the realities of real world
practice and availability. I suspect also that those moving away from
RSASSA-PKCS1-v1_5 will be looking to move to ECDSA due to more easily
quantified benefits of smaller keys and signatures rather than the more
abstract benefits of PSS.

Anyway, we disagree on this. And don't seem to be making any headway in
swaying one another. I wonder if there is any input for the WG or strong
opinions one way or the other?

On Wed, Aug 5, 2015 at 1:16 PM, Jim Schaad <[email-masked]> wrote:

> Although no attacks are known against RSASSA-PKCS1-v1_5, in the interest
> of increased robustness, RSASSA-PSS is required in new applications.
> RSASSA-PKCS1-v1_5 is included only for compatibility with existing
> applications.
>
>
>
> I would agree that there is an issue with deployment of PSS signatures,
> however there exists lots of code that implements it.  It has not been
> deployed widely because people are not using it widely.  However there are
> many cases where it is going to start being required.  For example, TLS is
> moving towards only accepting PSS in v1.3.
>
>
>
> I believe that we qualify as a “new application” and therefore we should
> be following the advice from RSA even if it may not popular with people
> doing deployments immediately.   I still would not expect any constrained
> deployments to be using RSA, so it will be interesting to see who picks
> this up and if they find it to be a problem.  I would not, for example, be
> expecting that this is going to take over the world of JWT (and this is one
> way which might slow down any such process).  However, I must admit that
> the fact they are using RSA rather than ECDSA to be disturbing due to the
> size issues for some browsers. (Although not, as I understand it, an issue
> for chrome.)
>
>
>
> Jim
>
>
>
>
>
> *Sent:* Tuesday, August 04, 2015 6:21 AM
>
> *To:* Jim Schaad
> *Cc:* [email-masked]

---

From: Mike Jones <[email-masked]>
Date: Mon, 10 Aug 2015 17:26:17 +0000

I think that including RSAES-PKCS1-v1_5 as a defined algorithm is essential.

From: COSE [mailto:[email-masked]] On Behalf Of Brian Campbell
Sent: Monday, August 10, 2015 10:15 AM
To: Jim Schaad
Cc: [email-masked]
Subject: Re: [COSE] RSA Algorithm Decisions

Yeah, I'm aware of the full text there. I quoted only the absence of known attacks on RSASSA-PKCS1-v1_5 because that seemed to be your main concern with RSAES-PKCS1-v1_5 (though a bit of a detour because I wasn't suggesting that one). I think compatibility with support in existing platforms and libraries is sufficient reason to include RSASSA-PKCS1-v1_5 and that omitting it would be a mistake that ignores the realities of real world practice and availability. I suspect also that those moving away from RSASSA-PKCS1-v1_5 will be looking to move to ECDSA due to more easily quantified benefits of smaller keys and signatures rather than the more abstract benefits of PSS.

Anyway, we disagree on this. And don't seem to be making any headway in swaying one another. I wonder if there is any input for the WG or strong opinions one way or the other?

On Wed, Aug 5, 2015 at 1:16 PM, Jim Schaad <[email-masked]<mailto:[email-masked]>> wrote:
First, let’s get the full quote from PKCS#1 V2.2 instead of just the partial quote that you included.

Jim

From: Brian Campbell [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Tuesday, August 04, 2015 6:21 AM

To: Jim Schaad
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [COSE] RSA Algorithm Decisions

On Mon, Aug 3, 2015 at 6:00 PM, Jim Schaad <[email-masked]<mailto:[email-masked]>> wrote:
When I said there is no legacy, I was referring to the fact that there is currently no code base that is using COSE as a message format.  This is different than JOSE where, as you point out, there is a large amount of RSA v1.5 that was being used even before the JOSE specifications were really finalized.

jim

From: Brian Campbell [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Monday, August 03, 2015 3:26 PM
To: Jim Schaad
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [COSE] RSA Algorithm Decisions

On Mon, Aug 3, 2015 at 3:19 PM, Brian Campbell <[email-masked]<mailto:[email-masked]>> wrote:
I'm not sure what you mean that there is no legacy that needs to be supported for COSE?
Short of implementing algorithms from scratch, which I expect to be very rare, COSE implementations will be constrained in their algorithm support by what is available from the the underlying platform or easily accessible libraries.
From what I've seen, RSASSA-PKCS1-v1_5 is still the most commonly available and most widely used RSA based signature mechanism.  If RSA is being included for completeness, RSASSA-PKCS1-v1_5 should also be included.

On Thu, Jul 30, 2015 at 4:32 PM, Jim Schaad <[email-masked]<mailto:[email-masked]>> wrote:
I am currently in the process of updating/expanding the text for RSA.  This
message is what I am using the control the decision process.

Jim

_______________________________________________
COSE mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/cose<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7cbb18e1ec309a4e3f52a208d2a1a74eb5%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=suPS%2fxToAvvkpTaW23JJHQoY5akxsTZgzkLkM4qDoBc%3d>

---

From: "Jim Schaad" <[email-masked]>
Date: Thu, 13 Aug 2015 10:53:20 -0700

Brian,

I wonder if you have any contacts inside of google to query them why they went with RSA v1.5.  However, I think that if you do it might be because of the implementation requirements in the JOSE algorithms draft.   I just looked and RS256 is labeled as recommended, but PS256 is labeled as optional.  It appears that similar language is in the JWT draft.   We may find the decision to use RSA v1.5 by google had more to do with expected JWT libraries than with crypto library support.

Jim

---

From: Mike Jones <[email-masked]>
Date: Thu, 13 Aug 2015 18:02:10 +0000

Google was using RSA v1.5 (with 1024 bit keys) to sign their proprietary tokens before JWT existed.  I'm sure it was because it's ubiquitously available in all Web development tools - as we determined in the survey of algorithms supported by common Web development platforms done by the JOSE working group in mid-2012 (attached).

				-- Mike

-----Original Message-----
From: COSE [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Thursday, August 13, 2015 1:53 PM
To: 'Brian Campbell'
Cc: [email-masked]
Subject: Re: [COSE] RSA Algorithm Decisions

Brian,

Jim

_______________________________________________
COSE mailing list
[email-masked]
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c0938b3fbedae40ec80d608d2a4080844%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=TP7B%2f1awN7E4VpAREAuAG2EN7NfR9cSJ265o8PMOLn0%3d

---

From: Brian Campbell <[email-masked]>
Date: Thu, 13 Aug 2015 12:28:48 -0600

I know a couple folks and I'll make an informal query to them.  They may or
may not know the answer and may or may not reply. But I'll try.

I suspect Mike is more right than not, however, which was basically the
impetus for my using them as an example in the first place.

On Thu, Aug 13, 2015 at 12:02 PM, Mike Jones <[email-masked]>
wrote:

> Google was using RSA v1.5 (with 1024 bit keys) to sign their proprietary
> tokens before JWT existed.  I'm sure it was because it's ubiquitously
> available in all Web development tools - as we determined in the survey of
> algorithms supported by common Web development platforms done by the JOSE
> working group in mid-2012 (attached).
>
>                                 -- Mike
>
> I wonder if you have any contacts inside of google to query them why they
> went with RSA v1.5.  However, I think that if you do it might be because of
> the implementation requirements in the JOSE algorithms draft.   I just
> looked and RS256 is labeled as recommended, but PS256 is labeled as
> optional.  It appears that similar language is in the JWT draft.   We may
> find the decision to use RSA v1.5 by google had more to do with expected
> JWT libraries than with crypto library support.
>
> Jim
>
>

---

From: Mike Jones <[email-masked]>
Date: Thu, 13 Aug 2015 18:30:39 +0000

Dirk – you’re on this list, correct?  Do you have any comments on why Google is using RSASSA v1.5 to sign things?

                                                            -- Mike

From: Brian Campbell [mailto:[email-masked]]
Sent: Thursday, August 13, 2015 2:29 PM
To: Mike Jones
Cc: Jim Schaad; [email-masked]
Subject: Re: [COSE] RSA Algorithm Decisions

I know a couple folks and I'll make an informal query to them.  They may or may not know the answer and may or may not reply. But I'll try.
I suspect Mike is more right than not, however, which was basically the impetus for my using them as an example in the first place.

On Thu, Aug 13, 2015 at 12:02 PM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:
Google was using RSA v1.5 (with 1024 bit keys) to sign their proprietary tokens before JWT existed.  I'm sure it was because it's ubiquitously available in all Web development tools - as we determined in the survey of algorithms supported by common Web development platforms done by the JOSE working group in mid-2012 (attached).

                                -- Mike

-----Original Message-----
From: COSE [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Jim Schaad
Sent: Thursday, August 13, 2015 1:53 PM
To: 'Brian Campbell'
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [COSE] RSA Algorithm Decisions
Brian,

Jim

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 13 Aug 2015 14:35:28 -0400

It would be good to get an answer from folks actually using it, but
there is no reason we can't move forward without it.  Google and other
vendors have been very good about deprecating algorithms and protocols
in their products, and even making customers aware when they are in
use (browsers with https in red with a strikethrough and Mozilla using
a yellow caution triangle).

Since COSE isn't deployed yet, I think it's okay and a good thing to
be forward thinking.

Kathleen

On Thu, Aug 13, 2015 at 2:30 PM, Mike Jones <[email-masked]> wrote:
> find the decision to use RSA v1.5 by google had more to do with expected JWT
> libraries than with crypto library support.
>
> Jim
>

-- 

Best regards,
Kathleen

---

From: Brian Campbell <[email-masked]>
Date: Mon, 17 Aug 2015 07:22:07 -0600

I got an answer back from Google on their selection of RSASSA-PKCS1-v1_5
for signing of tokens, which I'll quote here:

"We [Google] will always use an asymmetric alg so we can rotate keys.  Of
the asymmetric algs, RSA 1.5 was chosen due to its wide availability for
client libraries at the time.  If we were to support a newer alg in the
future, it would also be an asymmetric one."

On Thu, Aug 13, 2015 at 12:35 PM, Kathleen Moriarty <
[email-masked]> wrote:

> > Dirk – you’re on this list, correct?  Do you have any comments on why
> Google
> > is using RSASSA v1.5 to sign things?
> >
> >
> >
> >                                                             -- Mike
> >
> >
> >
> JWT

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 17 Aug 2015 09:34:31 -0400

Thanks for tracking that down.  If we were to not include it, we would
just need to recommend an asymmetric choice and ask them to join the
discussion.  Google and other organizations are usually very good
about staying with current recommendation.  Since COSE has not been
implemented, it seems like a good time to do the right thing.

Thanks,
Kathleen

On Mon, Aug 17, 2015 at 9:22 AM, Brian Campbell
<[email-masked]> wrote:
> I got an answer back from Google on their selection of RSASSA-PKCS1-v1_5 for
> signing of tokens, which I'll quote here:
>
> On Thu, Aug 13, 2015 at 12:35 PM, Kathleen Moriarty
> <[email-masked]> wrote:
>>

-- 

Best regards,
Kathleen

---

From: Brian Campbell <[email-masked]>
Date: Mon, 17 Aug 2015 11:50:46 -0600

I didn't bring up Google's use of RSA1.5 with respect to them using or not
using COSE. I don't know about their interest in COSE one way or the other.

I brought it up as a proxy, of sorts, for a sampling of real world support
for asymmetric signature algorithms in practice out in the 'real world'.
They are signing tokens which will be consumed on an extremely wide variety
of platforms and systems. They chose RSA1.5 for that due to its "wide
availability."

On Mon, Aug 17, 2015 at 7:34 AM, Kathleen Moriarty <
[email-masked]> wrote:

> for
> >> On Thu, Aug 13, 2015 at 2:30 PM, Mike Jones <
> [email-masked]>
> >> wrote:
> >> > I know a couple folks and I'll make an informal query to them.  They
> may
> >> > or
> >> > available in all Web development tools - as we determined in the
> survey
> >> > of
> >> > went with RSA v1.5.  However, I think that if you do it might be
> because
> >> > of

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 17 Aug 2015 13:14:22 -0700

That was definitely my understanding of your position.  I asked the question about Google simply because I was trying to determine if the issue was really the deployment question or the question of how the specs for JOSE were written.

Like Brian, I don’t know that Google would or would not have any interest in ever using COSE.  I do know from personal experience that it is not the easiest thing to implement in JavaScript due to the fact that we are using integers as keys rather than strictly sticking to strings.  Even the easy mapping (make the integer a string) would not necessarily work in the long run as COSE would support both having keys of 1 (as a number) and “1” (as a string) for a map key value.   This makes any direct JavaScript support lots of fun.

Jim

From: Brian Campbell [mailto:[email-masked]] 
Sent: Monday, August 17, 2015 10:51 AM
To: Kathleen Moriarty
Cc: Mike Jones; Dirk Balfanz; Jim Schaad; [email-masked]
Subject: Re: [COSE] RSA Algorithm Decisions

I didn't bring up Google's use of RSA1.5 with respect to them using or not using COSE. I don't know about their interest in COSE one way or the other. 

I brought it up as a proxy, of sorts, for a sampling of real world support for asymmetric signature algorithms in practice out in the 'real world'. They are signing tokens which will be consumed on an extremely wide variety of platforms and systems. They chose RSA1.5 for that due to its "wide availability."   

On Mon, Aug 17, 2015 at 7:34 AM, Kathleen Moriarty <[email-masked] <mailto:[email-masked]> > wrote:

Thanks,
Kathleen

On Mon, Aug 17, 2015 at 9:22 AM, Brian Campbell
<[email-masked] <mailto:[email-masked]> > wrote:
> <[email-masked] <mailto:[email-masked]> > wrote:
>>
>> On Thu, Aug 13, 2015 at 2:30 PM, Mike Jones <[email-masked] <mailto:[email-masked]> >
>> wrote:
>> > Cc: Jim Schaad; [email-masked] <mailto:[email-masked]> 
>> > On Thu, Aug 13, 2015 at 12:02 PM, Mike Jones
>> > <[email-masked] <mailto:[email-masked]> >
>> > wrote:
>> >
>> > From: COSE [mailto:[email-masked] <mailto:[email-masked]> ] On Behalf Of Jim Schaad
>> > https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c0938b3fbedae40ec80d608d2a4080844%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=TP7B%2f1awN7E4VpAREAuAG2EN7NfR9cSJ265o8PMOLn0%3d> &data=01%7c01%7cMichael.Jones%40microsoft.com%7c0938b3fbedae40ec80d608d2a4080844%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=TP7B%2f1awN7E4VpAREAuAG2EN7NfR9cSJ265o8PMOLn0%3d
>> >
>> >
>> >
>> >

--

Best regards,
Kathleen

---

From: Mike Jones <[email-masked]>
Date: Tue, 18 Aug 2015 04:31:20 +0000

I’m personally queasy with not defining an algorithm identifier for RSASSA v1.5 unless we first undertake a study equivalent to the attached algorithm availability survey and convince ourselves that RSA-PSS is now ubiquitously available.  Given that there are no known attacks on RSASSA v1.5, trying to rule out the use of the most commonly used signature algorithm without first doing the study seems premature to me.

                                                            -- Mike

From: Jim Schaad [mailto:[email-masked]]
Sent: Monday, August 17, 2015 1:14 PM
To: 'Brian Campbell'; 'Kathleen Moriarty'
Cc: Mike Jones; 'Dirk Balfanz'; [email-masked]
Subject: RE: [COSE] RSA Algorithm Decisions

Jim

From: Brian Campbell [mailto:[email-masked]]
Sent: Monday, August 17, 2015 10:51 AM
To: Kathleen Moriarty
Cc: Mike Jones; Dirk Balfanz; Jim Schaad; [email-masked]<mailto:[email-masked]>
Subject: Re: [COSE] RSA Algorithm Decisions

On Mon, Aug 17, 2015 at 7:34 AM, Kathleen Moriarty <[email-masked]<mailto:[email-masked]>> wrote:

Thanks,
Kathleen

On Mon, Aug 17, 2015 at 9:22 AM, Brian Campbell
<[email-masked]<mailto:[email-masked]>> wrote:
> <[email-masked]<mailto:[email-masked]>> wrote:
>>
>> On Thu, Aug 13, 2015 at 2:30 PM, Mike Jones <[email-masked]<mailto:[email-masked]>>
>> wrote:
>> > Cc: Jim Schaad; [email-masked]<mailto:[email-masked]>
>> > <[email-masked]<mailto:[email-masked]>>
>> > wrote:
>> >
>> > https://www.ietf.org/mailman/listinfo/cose<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c4749b3528cfe485c094f08d2a7406620%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=%2fSrvdVTOSVnsdM8Wj84jLvPSSF0sXxp7iai6OPRHDT4%3d>
>> >
>>
>>
>>
>> --
>>
>> Best regards,
>> Kathleen
>
>

--

Best regards,
Kathleen

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 17 Aug 2015 22:05:05 -0700

So what are the use cases you think we need to support this in?  That would be the first thing that one would need to look at before one can make any guesses as to what environments we need to do the inventory for.

Jim

From: Mike Jones [mailto:[email-masked]] 
Sent: Monday, August 17, 2015 9:31 PM
To: Jim Schaad; 'Brian Campbell'; 'Kathleen Moriarty'
Cc: 'Dirk Balfanz'; [email-masked]
Subject: RE: [COSE] RSA Algorithm Decisions

                                                            -- Mike

Cc: Mike Jones; 'Dirk Balfanz'; [email-masked] <mailto:[email-masked]> 

Jim

From: Brian Campbell [mailto:[email-masked]] 
Sent: Monday, August 17, 2015 10:51 AM
To: Kathleen Moriarty
Cc: Mike Jones; Dirk Balfanz; Jim Schaad; [email-masked] <mailto:[email-masked]> 
Subject: Re: [COSE] RSA Algorithm Decisions

Thanks,
Kathleen

On Mon, Aug 17, 2015 at 9:22 AM, Brian Campbell
<[email-masked] <mailto:[email-masked]> > wrote:
>> > https://www.ietf.org/mailman/listinfo/cose <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c4749b3528cfe485c094f08d2a7406620%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=%2fSrvdVTOSVnsdM8Wj84jLvPSSF0sXxp7iai6OPRHDT4%3d> 
>> >
>>
>>
>>
>> --
>>
>> Best regards,
>> Kathleen
>
>

--

Best regards,
Kathleen

---

From: Mike Jones <[email-masked]>
Date: Tue, 18 Aug 2015 05:16:25 +0000

Among others, I think we should look at the popular embedded systems toolkits, such as the offering from Wind River.  Others will have more current knowledge of these than me.

-- Mike
________________________________
From: Jim Schaad<mailto:[email-masked]>
Sent: ‎8/‎17/‎2015 10:04 PM
To: Mike Jones<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>
Subject: RE: [COSE] RSA Algorithm Decisions

Jim

                                                            -- Mike

Cc: Mike Jones; 'Dirk Balfanz'; [email-masked]<mailto:[email-masked]>

Jim

Thanks,
Kathleen

--

Best regards,
Kathleen

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 17 Aug 2015 22:52:45 -0700

But it is unlikely that embedded systems are going to use RSA –they are
going to use ECDSA in all probability.

From: Mike Jones [mailto:[email-masked]] 
Sent: Monday, August 17, 2015 10:16 PM
To: Jim Schaad
Cc: [email-masked]
Subject: RE: [COSE] RSA Algorithm Decisions

Among others, I think we should look at the popular embedded systems
toolkits, such as the offering from Wind River.  Others will have more
current knowledge of these than me.

-- Mike

  _____  

From: Jim Schaad <mailto:[email-masked]> 
Sent: ‎8/‎17/‎2015 10:04 PM
To: Mike Jones <mailto:[email-masked]> 
Cc: [email-masked] <mailto:[email-masked]> 
Subject: RE: [COSE] RSA Algorithm Decisions

So what are the use cases you think we need to support this in?  That would
be the first thing that one would need to look at before one can make any
guesses as to what environments we need to do the inventory for.

Jim

Cc: 'Dirk Balfanz'; [email-masked] <mailto:[email-masked]> 

I’m personally queasy with not defining an algorithm identifier for RSASSA
v1.5 unless we first undertake a study equivalent to the attached algorithm
availability survey and convince ourselves that RSA-PSS is now ubiquitously
available.  Given that there are no known attacks on RSASSA v1.5, trying to
rule out the use of the most commonly used signature algorithm without first
doing the study seems premature to me.

                                                            -- Mike

That was definitely my understanding of your position.  I asked the question
about Google simply because I was trying to determine if the issue was
really the deployment question or the question of how the specs for JOSE
were written.

Like Brian, I don’t know that Google would or would not have any interest in
ever using COSE.  I do know from personal experience that it is not the
easiest thing to implement in JavaScript due to the fact that we are using
integers as keys rather than strictly sticking to strings.  Even the easy
mapping (make the integer a string) would not necessarily work in the long
run as COSE would support both having keys of 1 (as a number) and “1” (as a
string) for a map key value.   This makes any direct JavaScript support lots
of fun.

Jim

<mailto:[email-masked]> 

On Mon, Aug 17, 2015 at 7:34 AM, Kathleen Moriarty
<[email-masked] <mailto:[email-masked]>

Thanks,
Kathleen

for
> <[email-masked]
may
because
>> > libraries than with crypto library support.
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.or
g%2fmailman%2flistinfo%2fcose
<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.o
rg%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%
7c0938b3fbedae40ec80d608d2a4080844%7c72f988bf86f141af91ab2d7cd011db47%7c1&sd
ata=TP7B%2f1awN7E4VpAREAuAG2EN7NfR9cSJ265o8PMOLn0%3d>
&data=01%7c01%7cMichael.Jones%40microsoft.com%7c0938b3fbedae40ec80d608d2a408
0844%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=TP7B%2f1awN7E4VpAREAuAG2EN
7NfR9cSJ265o8PMOLn0%3d
<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.o
rg%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%
7c4749b3528cfe485c094f08d2a7406620%7c72f988bf86f141af91ab2d7cd011db47%7c1&sd
ata=%2fSrvdVTOSVnsdM8Wj84jLvPSSF0sXxp7iai6OPRHDT4%3d> 

--

Best regards,
Kathleen

---

From: John Bradley <[email-masked]>
Date: Tue, 18 Aug 2015 12:37:26 -0300

I think we need to look at that around supporting RSA v1.5 for signature. 

My gut feeling is that no one is really going to be interested in RSA PSS signatures.   If we don’t include RSA v1.5 then we probably should simplify things for COSE and not include RSA at all.

That might be hard line but the right thing if this really is targeted at constrained systems.   Using RSA will make people want to use 1028bit or smaller keys and that is becoming more theatre than security even with PSS.

I think the Google use of RSA v1.5 goes back to this https://salmon-protocol.googlecode.com/svn/trunk/draft-panzer-magicsig-00.html <https://salmon-protocol.googlecode.com/svn/trunk/draft-panzer-magicsig-00.html> when Nat and I first talked to them about unifying with JSON Simple Sign before JOSE.

The issue for them was having something that developers could implement.  They wanted no signature agility at the time, and we argued for allowing PSS and EC signatures as a option at the time.

It is the ability of clients to verify signatures not them signing them that continues to be the concern.  I have no idea if there is any interest in COSE at the moment  in Google.

On the JWT side I prefer to lobby for implementing EC signatures as a option for clients rather then PSS, as it is a bigger benefit for about the same amount of work in any cases.

John B.

> On Aug 18, 2015, at 2:16 AM, Mike Jones <[email-masked]> wrote:
> 
> From: Jim Schaad [mailto:[email-masked] <mailto:[email-masked]>] 
> From: Brian Campbell [mailto:[email-masked] <mailto:[email-masked]>] 
> On Mon, Aug 17, 2015 at 7:34 AM, Kathleen Moriarty <[email-masked] <mailto:[email-masked]>> wrote:
> <[email-masked] <mailto:[email-masked]>> wrote:
> > <[email-masked] <mailto:[email-masked]>> wrote:
> >>
> >> On Thu, Aug 13, 2015 at 2:30 PM, Mike Jones <[email-masked] <mailto:[email-masked]>>
> >> wrote:
> >> > From: Brian Campbell [mailto:[email-masked] <mailto:[email-masked]>]
> >> > <[email-masked] <mailto:[email-masked]>>
> >> > wrote:
> >> >
> >> > From: COSE [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Jim Schaad
> >> > https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c0938b3fbedae40ec80d608d2a4080844%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=TP7B%2f1awN7E4VpAREAuAG2EN7NfR9cSJ265o8PMOLn0%3d <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c0938b3fbedae40ec80d608d2a4080844%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=TP7B%2f1awN7E4VpAREAuAG2EN7NfR9cSJ265o8PMOLn0%3d>
> >> >
> >> >
> >> >
> >> >

---

From: "Jim Schaad" <[email-masked]>
Date: Tue, 18 Aug 2015 16:28:36 -0700

I would have no problems with pulling all of the RSA algorithms from the draft.

Jim

From: John Bradley [mailto:[email-masked]] 
Sent: Tuesday, August 18, 2015 8:37 AM
To: Michael Jones
Cc: Jim Schaad; [email-masked]
Subject: Re: [COSE] RSA Algorithm Decisions

I think the Google use of RSA v1.5 goes back to this https://salmon-protocol.googlecode.com/svn/trunk/draft-panzer-magicsig-00.html when Nat and I first talked to them about unifying with JSON Simple Sign before JOSE.

John B.

On Aug 18, 2015, at 2:16 AM, Mike Jones <[email-masked] <mailto:[email-masked]> > wrote:

-- Mike

  _____  

From:  <mailto:[email-masked]> Jim Schaad
Sent: ‎8/‎17/‎2015 10:04 PM
To:  <mailto:[email-masked]> Mike Jones
Cc:  <mailto:[email-masked]> [email-masked]
Subject: RE: [COSE] RSA Algorithm Decisions

Jim

                                                            -- Mike

From: Jim Schaad [ <mailto:[email-masked]> mailto:[email-masked]] 
Sent: Monday, August 17, 2015 1:14 PM
To: 'Brian Campbell'; 'Kathleen Moriarty'
Cc: Mike Jones; 'Dirk Balfanz';  <mailto:[email-masked]> [email-masked]
Subject: RE: [COSE] RSA Algorithm Decisions

Jim

From: Brian Campbell [ <mailto:[email-masked]> mailto:[email-masked]] 
Sent: Monday, August 17, 2015 10:51 AM
To: Kathleen Moriarty
Cc: Mike Jones; Dirk Balfanz; Jim Schaad;  <mailto:[email-masked]> [email-masked]
Subject: Re: [COSE] RSA Algorithm Decisions

On Mon, Aug 17, 2015 at 7:34 AM, Kathleen Moriarty < <mailto:[email-masked]> [email-masked]> wrote:

Thanks,
Kathleen

On Mon, Aug 17, 2015 at 9:22 AM, Brian Campbell
< <mailto:[email-masked]> [email-masked]> wrote:
> < <mailto:[email-masked]> [email-masked]> wrote:
>>
>> On Thu, Aug 13, 2015 at 2:30 PM, Mike Jones < <mailto:[email-masked]> [email-masked]>
>> wrote:
>> > From: Brian Campbell [mailto: <mailto:[email-masked]> [email-masked]]
>> > Cc: Jim Schaad;  <mailto:[email-masked]> [email-masked]
>> > < <mailto:[email-masked]> [email-masked]>
>> > wrote:
>> >
>> > From: COSE [mailto: <mailto:[email-masked]> [email-masked]] On Behalf Of Jim Schaad
>> > Cc:  <mailto:[email-masked]> [email-masked]
>> >  <mailto:[email-masked]> [email-masked]
>> >
>> >  <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c0938b3fbedae40ec80d608d2a4080844%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=TP7B%2f1awN7E4VpAREAuAG2EN7NfR9cSJ265o8PMOLn0%3d> https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c0938b3fbedae40ec80d608d2a4080844%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=TP7B%2f1awN7E4VpAREAuAG2EN7NfR9cSJ265o8PMOLn0%3d
>> >
>> >
>> >
>> >
>> >  <mailto:[email-masked]> [email-masked]
>> >  <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c4749b3528cfe485c094f08d2a7406620%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=%2fSrvdVTOSVnsdM8Wj84jLvPSSF0sXxp7iai6OPRHDT4%3d> https://www.ietf.org/mailman/listinfo/cose
>> >
>>
>>
>>
>> --
>>
>> Best regards,
>> Kathleen
>
>

--

Best regards,
Kathleen

---

From: Justin Richer <[email-masked]>
Date: Tue, 18 Aug 2015 20:48:46 -0400

As chair, I want to remind the working group that one of the goals here 
in COSE is cryptographic agility. If there is a need or desire to add 
the RSA algorithms (or any others) back into the COSE fold, we can do so 
with a supplementary draft that defines the algorithm point and the 
methods for fitting them into the appropriate signature and encryption 
structures.

That said, I want to make sure that the editors and WG members make sure 
that the structures chosen are generally re-usable for the time when 
such new algorithms are added. I believe the current structures are, and 
we should endeavour not to lose that feature.

  -- Justin (as your COSE chair)

On 8/18/2015 7:28 PM, Jim Schaad wrote:
> *From:*John Bradley [mailto:[email-masked]]
> *Sent:* Tuesday, August 18, 2015 8:37 AM
> *To:* Michael Jones
> *Cc:* Jim Schaad; [email-masked]
> My gut feeling is that no one is really going to be interested in RSA 
> PSS signatures.   If we don’t include RSA v1.5 then we probably should 
> simplify things for COSE and not include RSA at all.
>
> That might be hard line but the right thing if this really is targeted 
> at constrained systems. Using RSA will make people want to use 1028bit 
> or smaller keys and that is becoming more theatre than security even 
> with PSS.
>
> I think the Google use of RSA v1.5 goes back to this 
> https://salmon-protocol.googlecode.com/svn/trunk/draft-panzer-magicsig-00.html when 
> Nat and I first talked to them about unifying with JSON Simple Sign 
> before JOSE.
>
> The issue for them was having something that developers could 
> implement.  They wanted no signature agility at the time, and we 
> argued for allowing PSS and EC signatures as a option at the time.
>
> It is the ability of clients to verify signatures not them signing 
> them that continues to be the concern.  I have no idea if there is any 
> interest in COSE at the moment  in Google.
>
> On the JWT side I prefer to lobby for implementing EC signatures as a 
> option for clients rather then PSS, as it is a bigger benefit for 
> about the same amount of work in any cases.
>
> John B.
>
>     On Aug 18, 2015, at 2:16 AM, Mike Jones
>     Among others, I think we should look at the popular embedded
>     systems toolkits, such as the offering from Wind River.  Others
>     will have more current knowledge of these than me.
>
>     -- Mike
>
>     ------------------------------------------------------------------------
>
>     *From:*Jim Schaad <mailto:[email-masked]>
>     *Sent:*‎8/‎17/‎2015 10:04 PM
>     *To:*Mike Jones <mailto:[email-masked]>
>     *Cc:[email-masked] <mailto:[email-masked]>
>     *Subject:*RE: [COSE] RSA Algorithm Decisions
>
>     So what are the use cases you think we need to support this in? 
>     That would be the first thing that one would need to look at
>     before one can make any guesses as to what environments we need to
>     do the inventory for.
>
>     Jim
>
>     *From:*Mike Jones [mailto:[email-masked]]
>     *Sent:*Monday, August 17, 2015 9:31 PM
>     *To:*Jim Schaad; 'Brian Campbell'; 'Kathleen Moriarty'
>     *Cc:*'Dirk Balfanz'; [email-masked] <mailto:[email-masked]>
>     *Subject:*RE: [COSE] RSA Algorithm Decisions
>
>     I’m personally queasy with not defining an algorithm identifier
>     for RSASSA v1.5 unless we first undertake a study equivalent to
>     the attached algorithm availability survey and convince ourselves
>     that RSA-PSS is now ubiquitously available.  Given that there are
>     no known attacks on RSASSA v1.5, trying to rule out the use of the
>     most commonly used signature algorithm without first doing the
>     study seems premature to me.
>
>     -- Mike
>
>     *From:*Jim Schaad [mailto:[email-masked]]
>     *Sent:*Monday, August 17, 2015 1:14 PM
>     *To:*'Brian Campbell'; 'Kathleen Moriarty'
>     *Cc:*Mike Jones; 'Dirk Balfanz';[email-masked] <mailto:[email-masked]>
>     *Subject:*RE: [COSE] RSA Algorithm Decisions
>
>     That was definitely my understanding of your position.  I asked
>     the question about Google simply because I was trying to determine
>     if the issue was really the deployment question or the question of
>     how the specs for JOSE were written.
>
>     Like Brian, I don’t know that Google would or would not have any
>     interest in ever using COSE.  I do know from personal experience
>     that it is not the easiest thing to implement in JavaScript due to
>     the fact that we are using integers as keys rather than strictly
>     sticking to strings.  Even the easy mapping (make the integer a
>     string) would not necessarily work in the long run as COSE would
>     support both having keys of 1 (as a number) and “1” (as a string)
>     for a map key value.   This makes any direct JavaScript support
>     lots of fun.
>
>     Jim
>
>     *From:*Brian Campbell [mailto:[email-masked]]
>     *Sent:*Monday, August 17, 2015 10:51 AM
>     *To:*Kathleen Moriarty
>     *Cc:*Mike Jones; Dirk Balfanz; Jim Schaad;[email-masked]
>     <mailto:[email-masked]>
>     *Subject:*Re: [COSE] RSA Algorithm Decisions
>
>     I didn't bring up Google's use of RSA1.5 with respect to them
>     using or not using COSE. I don't know about their interest in COSE
>     one way or the other.
>
>     I brought it up as a proxy, of sorts, for a sampling of real world
>     support for asymmetric signature algorithms in practice out in the
>     'real world'. They are signing tokens which will be consumed on an
>     extremely wide variety of platforms and systems. They chose RSA1.5
>     for that due to its "wide availability."
>
>     <mailto:[email-masked]>> wrote:
>
>         <[email-masked]
>         <mailto:[email-masked]>> wrote:
>         <mailto:[email-masked]>> wrote:
>         >>
>         >> On Thu, Aug 13, 2015 at 2:30 PM, Mike Jones
>         >> > Cc: Jim Schaad;[email-masked] <mailto:[email-masked]>
>         >> > I know a couple folks and I'll make an informal query to
>         them.  They may
>         >> > or
>         >> > available in all Web development tools - as we determined
>         in the survey
>         >> > of
>         >> > algorithms supported by common Web development platforms
>         done by the
>         >> > JOSE
>         >> > From: COSE [mailto:[email-masked]
>         <mailto:[email-masked]>] On Behalf Of Jim Schaad
>         >> > Cc:[email-masked] <mailto:[email-masked]>
>         >> > I wonder if you have any contacts inside of google to
>         query them why
>         >> > they
>         >> > went with RSA v1.5. However, I think that if you do it
>         might be because
>         >> > of
>         >> > optional.  It appears that similar language is in the JWT
>         draft.   We
>         >> > may
>         <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c4749b3528cfe485c094f08d2a7406620%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=%2fSrvdVTOSVnsdM8Wj84jLvPSSF0sXxp7iai6OPRHDT4%3d>
>         >> >
>         >>
>         >>
>         >>
>         >> --
>         >>
>         >> Best regards,
>         >> Kathleen
>         >
>         >
>
>         --
>
>         Best regards,
>         Kathleen
>