Subject: [jose] Call for adoption

From: "Jim Schaad" <[email-masked]>
Date: Wed, 13 Feb 2013 10:28:01 -0800

The chairs of the JOSE working group have dropped the ball on this (really
me).

At the last face-to-face meeting there was a call for the following
documents to become working group documents:

Draft-barnes-jose-use-cases
<http://www.myfitnesspal.com/foohttp:/datatracker.ietf.org/doc/draft-barnes-
jose-use-cases/>  - Use Cases and Requirements for JSON Object Signing and
Encryption (JOSE)

Draft-jones-jose-jwe-json-serialization
<http://datatracker.ietf.org/doc/draft-jones-jose-jwe-json-serialization/>
- JSON Web Encryption JSON Serialization (JWE-JS)

Draft-jones-jose-jws-json-serialization
<http://datatracker.ietf.org/doc/draft-jones-jose-jws-json-serialization/>
- JSON Web Signature JSON Serialization (JWS-JS)

The chairs are going to assume that the working group wants to adopt these
three documents as that was the overwhelming response in Atlanta.  Thus you
only need to reply if you object to these documents being adopted.  This
call will end 27 February.

(Note that we will be looking at the private key drafts during the Orlando
meeting and issuing an adoption call shortly after that meeting.)

Jim

---

From: Richard Barnes <[email-masked]>
Date: Wed, 13 Feb 2013 22:23:55 -0500

I support the adoption of the use cases draft.  Clearer use cases will help
this group refine a lot of the ideas that are floating around.

I do not support the adoption of the JSON serialization documents.  A JSON
serialization should be part of the base documents. I have already made a
proposal to the list for how to do this, which is essentially the same as
the one in the JSON serialization documents.  It would have a small impact
on the base specs, and make the base format much more usable.
http://www.ietf.org/mail-archive/web/jose/current/msg01465.html

--Richard

On Wednesday, February 13, 2013, Jim Schaad wrote:

> me).****
> ** **
> documents to become working group documents:****
>
> ** **
>
> Draft-barnes-jose-use-cases<http://www.myfitnesspal.com/foohttp:/datatracker.ietf.org/doc/draft-barnes-jose-use-cases/>– Use Cases and Requirements for JSON Object Signing and Encryption (JOSE)
> ****
>
> ** **
>
> Draft-jones-jose-jwe-json-serialization<http://datatracker.ietf.org/doc/draft-jones-jose-jwe-json-serialization/>– JSON Web Encryption JSON Serialization (JWE-JS)
> ****
>
> ** **
>
> Draft-jones-jose-jws-json-serialization<http://datatracker.ietf.org/doc/draft-jones-jose-jws-json-serialization/>– JSON Web Signature JSON Serialization (JWS-JS)
> ****
>
> ** **
>
> ** **
>
> call will end 27 February.****
>
> ** **
>
> meeting and issuing an adoption call shortly after that meeting.)****
>
> ** **
>
> Jim****
>
> ** **
>

---

From: Mike Jones <[email-masked]>
Date: Thu, 14 Feb 2013 06:23:15 +0000

Richard, I believe that your response is conflating two largely orthogonal things:  whether there should be a JSON serialization and whether it should be in the same document as the compact serialization.  The working group has been clear that it also wants a JSON serialization and that it wants the JSON serialization to enable multiple recipients.  The individual submission documents in question accomplish those goals and incorporate working group feedback received along the way.  I believe it represents forward progress to adopt them.

As was clarified during the rechartering discussion, the working group is free to combine deliverables.  If the working group decides to combine the compact serialization and the JSON serialization into a single deliverable, so be it.  But them not being combined at present shouldn't be grounds to thwart the working group's clear intent to support both serializations.

Once the JSON serialization is under working group control, feel free to lead a crusade to combine both serializations into one document. :)

Anyway, that's how I see it.  Looking forward to seeing you in Orlando...

                                                            Best wishes,
                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Richard Barnes
Sent: Wednesday, February 13, 2013 7:24 PM
To: Jim Schaad
Cc: [email-masked]
Subject: Re: [jose] Call for adoption

I support the adoption of the use cases draft.  Clearer use cases will help this group refine a lot of the ideas that are floating around.

I do not support the adoption of the JSON serialization documents.  A JSON serialization should be part of the base documents. I have already made a proposal to the list for how to do this, which is essentially the same as the one in the JSON serialization documents.  It would have a small impact on the base specs, and make the base format much more usable.
http://www.ietf.org/mail-archive/web/jose/current/msg01465.html

--Richard

On Wednesday, February 13, 2013, Jim Schaad wrote:
The chairs of the JOSE working group have dropped the ball on this (really me).

At the last face-to-face meeting there was a call for the following documents to become working group documents:

Draft-barnes-jose-use-cases<http://www.myfitnesspal.com/foohttp:/datatracker.ietf.org/doc/draft-barnes-jose-use-cases/> - Use Cases and Requirements for JSON Object Signing and Encryption (JOSE)

Draft-jones-jose-jwe-json-serialization<http://datatracker.ietf.org/doc/draft-jones-jose-jwe-json-serialization/> - JSON Web Encryption JSON Serialization (JWE-JS)

Draft-jones-jose-jws-json-serialization<http://datatracker.ietf.org/doc/draft-jones-jose-jws-json-serialization/> - JSON Web Signature JSON Serialization (JWS-JS)

The chairs are going to assume that the working group wants to adopt these three documents as that was the overwhelming response in Atlanta.  Thus you only need to reply if you object to these documents being adopted.  This call will end 27 February.

(Note that we will be looking at the private key drafts during the Orlando meeting and issuing an adoption call shortly after that meeting.)

Jim

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 14 Feb 2013 10:03:58 +0200

Hi Jim, 

I agree with Richard on the serialization documents. 

On the use cases I have a mixed view. As we have seen in the OAuth working group with use cases it is easy to get the group to add a new use case document but very difficult to get others to find reviewers to get it finished. I am not sure what the target audience would be with such a document. 

Let's assume that the audience for the document is the JOSE group. First, the requirements are not really adding a lot to the discussion since they are really basic (more or less what can be found in the charter). The use cases in Section 4 are out-of-date and are typically better described in the referenced documents. One of the four use cases is obsolete by now: the ATOCA use case is gone with the decisions from the last IETF meeting since the group entire group got trashed. ALTO IMHO does not seem to go anywhere either.

Sorry if I do not get excited anymore about the value of use case (and requirements) documents. The main challenges are that 

a) you don't want to describe use cases that relate to work where it hasn't even been decided to use the specific technology (in this case JSON), and 
b) when a use case of interest to the group is found that requires additional functionality then a new extension/solution is defined in a separate document that typically provides a better description than in the use case document itself.

Consequently, the value of separate use case document goes close to zero. 

Ciao
Hannes

On Feb 14, 2013, at 5:23 AM, Richard Barnes wrote:

> Draft-barnes-jose-use-cases – Use Cases and Requirements for JSON Object Signing and Encryption (JOSE)
> 
>  
> 
> Draft-jones-jose-jwe-json-serialization – JSON Web Encryption JSON Serialization (JWE-JS)
> 
>  
> 
> Draft-jones-jose-jws-json-serialization – JSON Web Signature JSON Serialization (JWS-JS)
> 
>  
> 
>  
> 
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: Brian Campbell <[email-masked]>
Date: Thu, 14 Feb 2013 06:23:20 -0700

For better or worse, I think Hannes' assessment of the value of use case
documents is spot on. And as such, I think it's legitimate to question the
inclusion of the JOSE use cases as a working group document.

Perhaps a case in point, I'd never actually read the use case document and
thought maybe I should at least take a glance before spouting off any
opinions here. So I went to find the doc in via the links in the original
message in this thread only to find that the use cases link was bad.

On Thu, Feb 14, 2013 at 1:03 AM, Hannes Tschofenig <
[email-masked]> wrote:

> On the use cases I have a mixed view. As we have seen in the OAuth working
> group with use cases it is easy to get the group to add a new use case
> document but very difficult to get others to find reviewers to get it
> finished. I am not sure what the target audience would be with such a
> document.
>
> Let's assume that the audience for the document is the JOSE group. First,
> the requirements are not really adding a lot to the discussion since they
> are really basic (more or less what can be found in the charter). The use
> cases in Section 4 are out-of-date and are typically better described in
> the referenced documents. One of the four use cases is obsolete by now: the
> ATOCA use case is gone with the decisions from the last IETF meeting since
> the group entire group got trashed. ALTO IMHO does not seem to go anywhere
> either.
>
> Sorry if I do not get excited anymore about the value of use case (and
> requirements) documents. The main challenges are that
>
> a) you don't want to describe use cases that relate to work where it
> hasn't even been decided to use the specific technology (in this case
> JSON), and
> b) when a use case of interest to the group is found that requires
> additional functionality then a new extension/solution is defined in a
> separate document that typically provides a better description than in the
> use case document itself.
>
> > I support the adoption of the use cases draft.  Clearer use cases will
> help this group refine a lot of the ideas that are floating around.
> >
> > I do not support the adoption of the JSON serialization documents.  A
> JSON serialization should be part of the base documents. I have already
> made a proposal to the list for how to do this, which is essentially the
> same as the one in the JSON serialization documents.  It would have a small
> impact on the base specs, and make the base format much more usable.
> > The chairs are going to assume that the working group wants to adopt
> these three documents as that was the overwhelming response in Atlanta.
>  Thus you only need to reply if you object to these documents being
> adopted.  This call will end 27 February.
> >
> >
> >
> > (Note that we will be looking at the private key drafts during the
> Orlando meeting and issuing an adoption call shortly after that meeting.)
> >
> >
> >
> > Jim
> >
> >
> >

---

From: John Bradley <[email-masked]>
Date: Thu, 14 Feb 2013 11:24:53 -0300

To be fair the reason the use-cased are hard to find is that they are not WG documents.

If we adopt the documents at least we can find them.   I think the use cases can hep us get on the sam page in the group something we haves had a challenge with on occasion

So I agree with Richard that draft-barnes-jose-use-cases (link included for Brian) become a WG item.

Not to suck up to Richard too much:)

I also agree with Mike that the two other documents Draft-jones-jose-jwe-json-serialization and Draft-jones-jose-jws-json-serialization become WG items, and fight it out later on the question of merging them with the base specs which may be a good idea.

I don't agree with Hannes just because:)

John B.

On 2013-02-14, at 10:23 AM, Brian Campbell <[email-masked]> wrote:

> For better or worse, I think Hannes' assessment of the value of use case documents is spot on. And as such, I think it's legitimate to question the inclusion of the JOSE use cases as a working group document.
> 
> Perhaps a case in point, I'd never actually read the use case document and thought maybe I should at least take a glance before spouting off any opinions here. So I went to find the doc in via the links in the original message in this thread only to find that the use cases link was bad.
> 
> 
> On Thu, Feb 14, 2013 at 1:03 AM, Hannes Tschofenig <[email-masked]> wrote:
> Hi Jim,
>

---

From: Brian Campbell <[email-masked]>
Date: Thu, 14 Feb 2013 08:51:49 -0700

Contrary to what you might believe John, I am actually capable of finding
the document myself. In fact, it's right there on the WG page so not
exactly hard to find. I wasn't asking for help tracking it down but rather
trying to show by example how, despite best intentions, the use case docs
tend to get second class treatment.

I should have learned by now that subtlety is lost on Bradley though ;)

We're all busy people and time is a real scarcity.  A use case document is
great in theory but rarely gets the attention it needs to be truly useful.

On Thu, Feb 14, 2013 at 7:24 AM, John Bradley <[email-masked]> wrote:

> If we adopt the documents at least we can find them.   I think the use
> cases can hep us get on the sam page in the group something we haves had a
> challenge with on occasion
>
> So I agree with Richard that draft-barnes-jose-use-cases<http://datatracker.ietf.org/doc/draft-barnes-jose-use-cases/> (link
> included for Brian) become a WG item.
>
> I also agree with Mike that the two other documents
> Draft-jones-jose-jwe-json-serialization<http://datatracker.ietf.org/doc/draft-jones-jose-jwe-json-serialization/>
>  and Draft-jones-jose-jws-json-serialization<http://datatracker.ietf.org/doc/draft-jones-jose-jws-json-serialization/> become
> WG items, and fight it out later on the question of merging them with the
> base specs which may be a good idea.
>
>> On the use cases I have a mixed view. As we have seen in the OAuth
>> working group with use cases it is easy to get the group to add a new use
>> case document but very difficult to get others to find reviewers to get it