Subject: [jose] POLL: Is KID sufficently defined

From: "Jim Schaad" <[email-masked]>
Date: Fri, 17 Aug 2012 16:35:19 +0930

<CHAIR>

If you voted at the face-2-face please do not vote again.  If you want to
provide comments please change the title from POLL to DISCUSS.

Is the current text for KID sufficiently defined and understood?

Room vote:  2 yes, 0 no, 1 discuss

---

From: "Manger, James H" <[email-masked]>
Date: Sun, 19 Aug 2012 21:21:40 +1000

NO

--
James Manger

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Jim Schaad
> Sent: Friday, 17 August 2012 5:05 PM
> To: [email-masked]
> Subject: [jose] POLL: Is KID sufficently defined
> 
> <CHAIR>
> 
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: <[email-masked]>
Date: Mon, 27 Aug 2012 10:15:10 +0200

YES

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Friday, August 17, 2012 9:05 AM
To: [email-masked]
Subject: [jose] POLL: Is KID sufficently defined

<CHAIR>

If you voted at the face-2-face please do not vote again.  If you want to provide comments please change the title from POLL to DISCUSS.

---

From: "HAYASHI, Tatsuya" <[email-masked]>
Date: Tue, 28 Aug 2012 15:55:19 +0900

YES

-- 
HAYASHI, Tatsuya
Lepidum Co. Ltd.

---

From: Richard Barnes <[email-masked]>
Date: Tue, 28 Aug 2012 15:02:14 +0700

I voted "NO" on this in the room, because I don't understand it.  Could one of you "YES" voters explain it? 

What does "kid" mean in the context of a public-key wrapped key?  Is it a public key?  If so, in what format?  How about in the context of key agreement?  

Thanks,
--Richard

-- 
Richard Barnes
Sent with Sparrow (http://www.sparrowmailapp.com/?sig)

On Tuesday, August 28, 2012 at 1:55 PM, HAYASHI, Tatsuya wrote:

> YES
> 
> On Mon, Aug 27, 2012 at 5:15 PM, <[email-masked] (mailto:[email-masked])> wrote:
> > YES
> > 
> > To: [email-masked] (mailto:[email-masked])
> > [email-masked] (mailto:[email-masked])
> > [email-masked] (mailto:[email-masked])
> [email-masked] (mailto:[email-masked])

---

From: Breno de Medeiros <[email-masked]>
Date: Tue, 28 Aug 2012 06:45:16 -0700

YES
On Aug 27, 2012 11:55 PM, "HAYASHI, Tatsuya" <[email-masked]>
wrote:

> > If you voted at the face-2-face please do not vote again.  If you want
> to provide comments please change the title from POLL to DISCUSS.
> >

---

From: Torsten Lodderstedt <[email-masked]>
Date: Tue, 28 Aug 2012 18:51:20 +0200

YES
Am 28.08.2012 15:45, schrieb Breno de Medeiros:
>
> YES
>
> On Aug 27, 2012 11:55 PM, "HAYASHI, Tatsuya" <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     YES
>
>     On Mon, Aug 27, 2012 at 5:15 PM,  <[email-masked]
>     <mailto:[email-masked]>> wrote:
>     > YES
>     >
>     > From: [email-masked] <mailto:[email-masked]>
>     [mailto:[email-masked] <mailto:[email-masked]>] On
>     Behalf Of Jim Schaad
>     > To: [email-masked] <mailto:[email-masked]>
>     > If you voted at the face-2-face please do not vote again.  If
>     you want to provide comments please change the title from POLL to
>     DISCUSS.
>     >
>     > [email-masked] <mailto:[email-masked]>
>     > [email-masked] <mailto:[email-masked]>
>     [email-masked] <mailto:[email-masked]>

---

From: Edmund Jay <[email-masked]>
Date: Tue, 28 Aug 2012 10:46:26 -0700 (PDT)

YES

________________________________
From: Jim Schaad <[email-masked]>
To: [email-masked]
Sent: Fri, August 17, 2012 12:07:30 AM
Subject: [jose] POLL: Is KID sufficently defined

<CHAIR>

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 28 Aug 2012 21:00:24 +0300

Richard has a point here. Here is the description from:
http://tools.ietf.org/html/draft-ietf-jose-json-web-key-05#section-4.3

The semantic of the kid is not defined.

So the question is not so much whether it is sufficiently defined but 
more "does it matter that it is not defined?"

The answer depends on what you want to use the key id for. If you ever 
have to assume a structure of the kid then you will have a problem. This 
could, for example, happen when you use it to make some authorization 
decisions and when you compare it against some existing other identities.

I am not even sure what the kid references. Does it always reference a 
key that is included in the payload it self or does it reference a key 
that is external to the payload? Will you ever have the case that you 
need to use part of the identifier structure to find the key? (e.g., to 
discover the right server where the key is stored?)

---

From: Chuck Mortimore <[email-masked]>
Date: Tue, 28 Aug 2012 12:12:11 -0700

YES

---

From: nov matake <[email-masked]>
Date: Wed, 29 Aug 2012 13:45:10 +0900

YES