Subject: [jose] Possible error in JWE document

From: Ludwig Seitz <[email-masked]>
Date: Tue, 21 May 2013 12:52:26 +0200

Hello,

I'm currently working on implementing parts of the JOSE standards, and I
think I have discovered a minor error in the JWE draft
(draft-ietf-jose-json-web-encryption-10).

In section B.3 the length of the AAD is 848 bits, but the AAL value is
encoded to 0x380 (which is 896), or have I missed something?

Regards,

Ludwig Seitz

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2 
Scheelevägen 17 
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: "Manger, James H" <[email-masked]>
Date: Wed, 22 May 2013 16:34:51 +1000

Ludwig,

> encoded to 0x380 (which is 896), or have I missed something?

It is encoded as [0, 0, 0, 0, 0, 0, 3, 80] — an array of 8 bytes shows as decimal numbers.
3 * 256 + 80 = 848
The digits '80' are decimal, not hex.

Showing binary quantities as arrays of decimal numbers is awful. But I guess the editors like it because it is JSON :(

--
James Manger

---

From: Ludwig Seitz <[email-masked]>
Date: Wed, 22 May 2013 09:17:10 +0200

> It is encoded as [0, 0, 0, 0, 0, 0, 3, 80] — an array of 8 bytes shows as decimal numbers.

In that case there is an inconsistency with 

draft-ietf-jose-json-web-algorithms-10

section C.1 and C.2

Where in both cases A is 42 bytes long (= 336 bits) and the AL is given
as [...,01, 50] = 1*256+50 = 306

Regards,

Ludwig Seitz

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2 
Scheelevägen 17 
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: Richard Barnes <[email-masked]>
Date: Wed, 22 May 2013 15:50:12 -0400

> Showing binary quantities as arrays of decimal numbers is awful. But I
> guess the editors like it because it is JSON :(
>

Major +1 to this.

> --
> James Manger
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>

---

From: Richard Barnes <[email-masked]>
Date: Wed, 22 May 2013 15:50:46 -0400

>> guess the editors like it because it is JSON :(

... by which I mean +1 to James.  Binary quantities should be hex, not
decimal.

---

From: Mike Jones <[email-masked]>
Date: Wed, 22 May 2013 20:10:57 +0000

JSON doesn't use a hex representation and these specs are intended to be JSON-friendly.  (See the charter. :))

                                                                -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Richard Barnes
Sent: Wednesday, May 22, 2013 12:51 PM
To: Manger, James H
Cc: Ludwig Seitz; [email-masked]
Subject: Re: [jose] Possible error in JWE document

On Wed, May 22, 2013 at 3:50 PM, Richard Barnes <[email-masked]<mailto:[email-masked]>> wrote:

Major +1 to this.

... by which I mean +1 to James.  Binary quantities should be hex, not decimal.

--
James Manger
_______________________________________________
jose mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jose

---

From: Richard Barnes <[email-masked]>
Date: Wed, 22 May 2013 16:16:27 -0400

Then to be consistent with everything else in the document, shouldn't the
binary stuff be base64url-encoded?

On Wed, May 22, 2013 at 4:10 PM, Mike Jones <[email-masked]>wrote:

>  JSON doesn’t use a hex representation and these specs are intended to be
> JSON-friendly.  (See the charter. J)****
>
> ** **
>
>                                                                 -- Mike***
> *
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *Richard Barnes
> *Sent:* Wednesday, May 22, 2013 12:51 PM
> *To:* Manger, James H
> *Cc:* Ludwig Seitz; [email-masked]
> *Subject:* Re: [jose] Possible error in JWE document****
>
> ** **
>
> On Wed, May 22, 2013 at 3:50 PM, Richard Barnes <[email-masked]> wrote:****
>
>  ** **
>
> guess the editors like it because it is JSON :(****
>
>  ** **
>
> Major +1 to this. ****
>
>  ** **
>
> decimal.****
> ** **
> ** **
>  ****
>    ** **
>  ****
> https://www.ietf.org/mailman/listinfo/jose****
>
>  ** **
>
>  ** **
>