Subject: Re: [jose] Integrity algorithm in JWE: HMAC only or any signature JWA?

From: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Date: Fri, 30 Mar 2012 13:01:45 -0700

Cheers Mike, I can get back to coding now :)

Vladimir

--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]

-------- Original Message --------
Subject: Re: [jose] Integrity algorithm in JWE: HMAC only or any
signature JWA?
From: Mike Jones <[email-masked]>
Date: Fri, March 30, 2012 12:29 pm
To: Vladimir Dzhuvinov / NimbusDS <[email-masked]>,
"[email-masked]" <[email-masked]>

The intent was to always use an HMAC algorithm for the integrity check.
Thanks for pointing out the need to clarify 4.1.

 -- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Vladimir Dzhuvinov / NimbusDS
Sent: Friday, March 30, 2012 12:47 AM
To: [email-masked]
Subject: [jose] Integrity algorithm in JWE: HMAC only or any signature
JWA?

Hi guys,

Today I started rewriting the JWE library code according to the latest
http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-01

I noticed that in this particular draft integrity was introduced but I'm
not sure about the algorithm scope:

Section 2 /Terminology/ says that HMAC is used to ensure the integrity
of the ciphertext and the parameters used to create it.

Section 4.1 /Reserved Parameter Names/ implies that any signature JWA
combination may be used.

Advise please :)

Vladimir

--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]

_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose

_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose