Subject: [jose] Integrity algorithm in JWE: HMAC only or any signature JWA?

From: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Date: Fri, 30 Mar 2012 00:46:59 -0700

Hi guys,

Today I started rewriting the JWE library code according to the latest
http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-01

I noticed that in this particular draft integrity was introduced but I'm
not sure about the algorithm scope:

Section 2 /Terminology/ says that HMAC is used to ensure the integrity
of the ciphertext and the parameters used to create it.

Section 4.1 /Reserved Parameter Names/ implies that any signature JWA
combination may be used.

Advise please :)

Vladimir

--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]

---

From: Mike Jones <[email-masked]>
Date: Fri, 30 Mar 2012 11:29:01 +0000

The intent was to always use an HMAC algorithm for the integrity check.  Thanks for pointing out the need to clarify 4.1.

				-- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Vladimir Dzhuvinov / NimbusDS
Sent: Friday, March 30, 2012 12:47 AM
To: [email-masked]
Subject: [jose] Integrity algorithm in JWE: HMAC only or any signature JWA?

Hi guys,

I noticed that in this particular draft integrity was introduced but I'm not sure about the algorithm scope:

Section 2 /Terminology/ says that HMAC is used to ensure the integrity of the ciphertext and the parameters used to create it.

Section 4.1 /Reserved Parameter Names/ implies that any signature JWA combination may be used.

Advise please :)

Vladimir

_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose