Subject: [jose] #30: Alighn key usages with WebCrypto

From: "jose issue tracker" <[email-masked]>
Date: Thu, 25 Jul 2013 12:07:42 -0000

#30: Alighn key usages with WebCrypto

 The WebCrypto group would like JOSE to align the key usages put into a JWK
 object with the ones in the WebCrypto documents.  This would do things
 like separate sign and verify and make the value a multi-value field.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-jose-json-web-
  [email-masked] |  [email-masked]
     Type:  defect       |     Status:  new
 Priority:  major        |  Milestone:
Component:  json-web-    |    Version:
  key                    |   Keywords:
 Severity:  -            |
-------------------------+-------------------------------------------------

Ticket URL: <http://tools.ietf.org/wg/jose/trac/ticket/30>
jose <http://tools.ietf.org/jose/>

---

From: "jose issue tracker" <[email-masked]>
Date: Sat, 27 Jul 2013 01:44:24 -0000

Comment (by [email-masked]):

 The idea behind use is to keep people from doing multiple things with the
 same key including using it in different algorithms.

 I think making it multi-valued goes against that general security
 principal.

 I think the uses WebCrypto are suggesting are in the correct direction but
 missing the mark.

 For asymmetric type keys you know if you are signing or verifying based on
 if you have a public or private key.
 If you want to say something more useful about restricting asymetric you
 want to say what padding you are using to keep people from signing with
 PSS & PKCS1.5.

 Saying wrap vs something else is a bit helpful but if we are going to
 restrict it beyond sign & encrypt, it probably needs to be some
 combination of crate/veriy and the alg.   Mixing algs with the same key
 leads to tears in general, (OK some cryptographer will be happy when they
 find the hole you accidentally create)

 So More precision on use yes, sign & encrypt are holders from a simpler
 RSA world.
 Multi value no, I think it is bound to make people lazy and make mistakes.

 John B.

  key                    |  Resolution:
 Keywords:               |

Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/30#comment:1>
jose <http://tools.ietf.org/jose/>