Subject: [Unbearable] Where is JOSE/JWS/JWT already used in tokbind?

From: Tony Arcieri <[email-masked]>
Date: Mon, 27 Jul 2015 16:05:31 -0700

Apologies to the chairs if this is further proceeding down the rabbit hole,
but I am legitimately confused interpreting your existing drafts and just
want some clarification and don't really want this thread to proceed beyond
my own self-edification, if that is ok.

On Sun, Jul 26, 2015 at 11:59 AM, Phil Hunt <[email-masked]> wrote:

> I think the use of JWS here is not introducing any new risks that we
> aren't already exposed to.
>
> We already use JWS in tokens and http payloads.
>

When you say "we", is this within the context of tokbind? If so, where is
that described in the drafts?

Or are you simply assuming everyone is using JWT for bearer tokens
nowadays? (which is not the case, I can assure you)

Please clarify. Thank you.

-- 
Tony Arcieri

---

From: Leif Johansson <[email-masked]>
Date: Tue, 28 Jul 2015 10:48:56 +0200

On 2015-07-28 01:05, Tony Arcieri wrote:
> Apologies to the chairs if this is further proceeding down the rabbit
> hole, but I am legitimately confused interpreting your existing drafts
> and just want some clarification and don't really want this thread to
> proceed beyond my own self-edification, if that is ok.
> 

rathole avoided

> On Sun, Jul 26, 2015 at 11:59 AM, Phil Hunt <[email-masked]
> <mailto:[email-masked]>> wrote:
> 
> When you say "we", is this within the context of tokbind? If so, where
> is that described in the drafts?
> 
> _______________________________________________
> Unbearable mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/unbearable
>

---

From: Leif Johansson <[email-masked]>
Date: Wed, 29 Jul 2015 11:26:47 +0200

>> proceed beyond my own self-edification, if that is ok.

To clarify: I mean that this line of discussion is perfectly reasonable
and doesn't lead the WG to rathole, as for instance a discussion of bugs
in JWS implementations would.

Personally (and Phil can correct me if I'm wrong) I believe he meant to
say that other parts of the web stack uses JWS, not that tokenbinding
does so today.

	Cheers Leif