Subject: [Curdle] Regarding X25519 in JOSE ...

From: "Matthew A. Miller" <[email-masked]>
Date: Mon, 24 Jul 2017 08:26:14 -0600

Hello all,

It was asked if any work more work is needed to add X25519 (and X448) to
JOSE.  I believe [RFC8037] covers that, so I don't think any more work
is necessary right now.

Thanks,

-- 
- m&m

Matthew A. Miller

[RFC8037] CFRG Elliptic Curve Diffie-Hellman (ECDH) and Signatures in
JSON Object Signing and Encryption (JOSE) <
https://tools.ietf.org/html/rfc8037 >

---

From: Anders Rundgren <[email-masked]>
Date: Mon, 24 Jul 2017 16:38:51 +0200

> JOSE.  I believe [RFC8037] covers that, so I don't think any more work

Would it be possible (and not too controversial) describing why
RFC8037 didn't overload the JWK "EC" specification?  The reason
for asking is because the Java camp intends reusing the EC classes
making "OKP" a JOSE-only concept.  Personally, I believe OKP is just
fine (=clean) and should be adopted not only by Java, but by PKCS #11
and .NET as well.

Anders

> 
> 
> Thanks,
> 
> 
> 
> _______________________________________________
> Curdle mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle
>

---

From: "Matthew A. Miller" <[email-masked]>
Date: Mon, 24 Jul 2017 11:04:57 -0600

> fine (=clean) and should be adopted not only by Java, but by PKCS #11

[ Please let's not re-litigate this decision ... ]

The JOSE WG did discuss this[1] (albeit prior to its adoption as a WG
item).  The rough consensus was to use a different "kty" to avoid
various incompatibilities (particularly with regards to the JWK
thumbprint definition, although others did come up).

- m&m

Matthew A. Miller

[1] https://mailarchive.ietf.org/arch/msg/jose/8-Mo069HvB9_WlT9M2GrgNYHvG0

---

From: Anders Rundgren <[email-masked]>
Date: Mon, 24 Jul 2017 21:53:55 +0200

> thumbprint definition, although others did come up).

I see.  For me this extract from RFC 8037

   Do not assume that there is an underlying elliptic curve,
   despite the existence of the "crv" and "x" parameters. (For instance,
   this key type could be extended to represent Diffie-Hellman (DH)
   algorithms based on hyperelliptic surfaces.)

was the primary reason why creating a new key type seemed natural,
although I (not being a cryptographer) do not actually know what a
hyperelliptic surface is :-)

https://github.com/cyberphone/java-cfrg-spec

Anders

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 24 Jul 2017 20:30:56 -0400

How about Ed25519 and Ed448? Did those get done as well?

---

From: Jim Schaad <[email-masked]>
Date: Tue, 25 Jul 2017 05:59:27 +0200

I hope they do not do this.  The encoding format for the Edwards curves and
for the other EC curves is not the same in any way shape or form.   They are
different not only for JOSE but also for ASN.1.  Reusing the same classes
would be a mistake.

-----Original Message-----
From: Curdle [mailto:[email-masked]] On Behalf Of Anders Rundgren
Sent: Monday, July 24, 2017 4:39 PM
To: Matthew A. Miller <[email-masked]>; [email-masked]
Subject: Re: [Curdle] Regarding X25519 in JOSE ...

On 2017-07-24 16:26, Matthew A. Miller wrote:
> Hello all,
> 
> It was asked if any work more work is needed to add X25519 (and X448) 
> to JOSE.  I believe [RFC8037] covers that, so I don't think any more 
> work is necessary right now.

Would it be possible (and not too controversial) describing why
RFC8037 didn't overload the JWK "EC" specification?  The reason for asking
is because the Java camp intends reusing the EC classes making "OKP" a
JOSE-only concept.  Personally, I believe OKP is just fine (=clean) and
should be adopted not only by Java, but by PKCS #11 and .NET as well.

Anders

---

From: Jim Schaad <[email-masked]>
Date: Tue, 25 Jul 2017 06:02:00 +0200

Yes, the document covers all four algorithms, although it only does pure signatures not hash signatures

Jim

From: Curdle [mailto:[email-masked]] On Behalf Of Phillip Hallam-Baker
Sent: Tuesday, July 25, 2017 2:31 AM
To: Matthew A. Miller <[email-masked]>
Cc: Curdle <[email-masked]>
Subject: Re: [Curdle] Regarding X25519 in JOSE ...

On Mon, Jul 24, 2017 at 10:26 AM, Matthew A. Miller <[email-masked] <mailto:[email-masked]> > wrote:

Hello all,

Thanks,

--
- m&m

Matthew A. Miller

_______________________________________________
Curdle mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/curdle

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 27 Jul 2017 07:58:46 -0400

Hash signatures are probably not needed since JOSE already has a hash
mechanism.

OK so looks like my action item from Prague is already done!

On Tue, Jul 25, 2017 at 12:02 AM, Jim Schaad <[email-masked]> wrote:

> *From:* Curdle [mailto:[email-masked]] *On Behalf Of *Phillip
> Hallam-Baker
> *Sent:* Tuesday, July 25, 2017 2:31 AM
> *To:* Matthew A. Miller <[email-masked]>
> *Cc:* Curdle <[email-masked]>
> *Subject:* Re: [Curdle] Regarding X25519 in JOSE ...
>
>
>