Subject: Re: [jose] JOSE and JWT specs updated for IETF 85 working group meetings

From: "Manger, James H" <[email-masked]>
Date: Thu, 8 Nov 2012 01:00:19 +1100

Dirkjan,
See http://www.ietf.org/mail-archive/web/jose/current/msg00620.html
and the rest of that thread for compression in JWS.

And we should use the issues tracker at http://tools.ietf.org/eg/jose/trac/report/1.
--
James Manger

----- Reply message -----
From: "Dirkjan Ochtman" <[email-masked]>
Date: Wed, Nov 7, 2012 11:14 pm
Subject: [jose] JOSE and JWT specs updated for IETF 85 working group meetings
To: "Michael Jones" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>

On Wed, Nov 7, 2012 at 11:06 AM, Michael Jones
<[email-masked]> wrote:
> I’ve made a small set of updates to the JSON Object Signing and Encryption
> (JOSE) and JSON Web Token (JWT) specs in preparation for the JOSE and OAuth
> working group meetings at IETF 85.  These updates incorporate resolutions to
> issues that have been discussed by the working groups since publication of
> the previous drafts.

How can I get someone to respond to my suggestions? Emailing to the
list twice (Oct 20 and Oct 30) hasn't helped so far. Is there a bug
tracker?

Cheers,

Dirkjan
_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose

---

From: Dirkjan Ochtman <[email-masked]>
Date: Wed, 7 Nov 2012 15:07:53 +0100

> And we should use the issues tracker at http://tools.ietf.org/eg/jose/trac/report/1.

Thanks for the response, the mailing list thread on compression makes
some sense.

Would it make sense to report a bug on clarifying the signing
operation (i.e. PKCS1 vs. "pure" RSA signing), or is that something
that should be discussed here first?

Cheers,

Dirkjan

---

From: "Manger, James H" <[email-masked]>
Date: Thu, 8 Nov 2012 09:40:43 +1100

> Would it make sense to report a bug on clarifying the signing operation
> (i.e. PKCS1 vs. "pure" RSA signing), or is that something that should
> be discussed here first?

Avoiding developer confusion is generally a good reason for clarifications, though I doubt reporting a bug on this specific point makes sense. Trying "pure" RSA signing was never a good choice as no one does that (and shouldn't do it).

The organisation between JWS/JWE/JWA/JWK/... is not great. Fixing that might help if it puts detailed examples closer to the definition of the algorithms they use.

--
James Manger