Subject: [jose] #36: Algorithm "none" should be removed

From: "jose issue tracker" <[email-masked]>
Date: Wed, 31 Jul 2013 17:20:19 -0000

#36: Algorithm "none" should be removed

 Rather than having an algorithm none, this should be a degenerate case of
 JWS that is defined by and detected in the JWS specification.  I would
 suggest that we define it as being - if the "alg" and "enc" items are
 absent, then there is no signature on the message.  This would still allow
 the "zip" item to be present on the message to give you both a data
 carrying JOSE object and allow for compression.  Additionally one could
 define a new typ value of "DATA" to indicate that we are just carrying a
 payload and it is not acutally a JWS object.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-jose-json-web-
  [email-masked] |  [email-masked]
     Type:  defect       |     Status:  new
 Priority:  major        |  Milestone:
Component:  json-web-    |    Version:
  signature              |   Keywords:
 Severity:  -            |
-------------------------+-------------------------------------------------

Ticket URL: <http://tools.ietf.org/wg/jose/trac/ticket/36>
jose <http://tools.ietf.org/jose/>

---

From: "jose issue tracker" <[email-masked]>
Date: Wed, 31 Jul 2013 21:18:35 -0000

Comment (by [email-masked]):

 This would break the invariant across JWS and JWE that there is always an
 "alg" value, making the structure of and processing of JOSE objects
 unnecessarily more complicated.

  signature              |  Resolution:
 Keywords:               |

Ticket URL: <http://tools.ietf.org/wg/jose/trac/ticket/36#comment:1>
jose <http://tools.ietf.org/jose/>

---

From: "jose issue tracker" <[email-masked]>
Date: Wed, 31 Jul 2013 22:29:37 -0000

Comment (by [email-masked]):

 This is totally backwards.  This is not breaking an invariant, it's
 enforcing two more important invariants:
 -- A JWS always has a signature
 -- Every "alg" value has a signing and verification algorithms.

 A JSON Web Signature object without a Signature is not a JSON Web
 Signature object.  It's not that unsigned content should be a JWS with no
 "alg" value -- it's that it shouldn't be a JWS *at* *all*.

 And to repeat: If you want to keep "none", you need to define the
 verification algorithm.

 If your apps require a JWS-but-not-actually, you need to fix your apps.

Ticket URL: <http://tools.ietf.org/wg/jose/trac/ticket/36#comment:2>
jose <http://tools.ietf.org/jose/>