Subject: [jose] Fwd: I-D Action: draft-miller-jose-pkix-key-00.txt

From: "Matt Miller (mamille2)" <[email-masked]>
Date: Tue, 12 Feb 2013 18:45:51 +0000

FYI...

- m&m

Matt Miller < [email-masked] >
Cisco Systems, Inc.

Begin forwarded message:

> From: <[email-masked]>
> Subject: I-D Action: draft-miller-jose-pkix-key-00.txt
> Date: February 12, 2013 11:39:47 AM MST
> To: <[email-masked]>
> Reply-To: <[email-masked]>
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> 
> 
> 	Title           : JSON Web Key (JWK) for PKIX Certificates
> 	Author(s)       : Matthew Miller
>                          Brian Campbell
> 	Filename        : draft-miller-jose-pkix-key-00.txt
> 	Pages           : 7
> 	Date            : 2013-02-12
> 
> Abstract:
>   This document defines a JSON Web Key (JWK) object to wrap PKIX
>   certificate chains.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-miller-jose-pkix-key
> 
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-miller-jose-pkix-key-00
> 
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Anthony Nadalin <[email-masked]>
Date: Tue, 12 Feb 2013 23:41:40 +0000

This seems to abuse JWK, as we are now looking at JWK to be just a bag and now its to hold a certificate or certificate chain which are much more that keys

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Matt Miller (mamille2)
Sent: Tuesday, February 12, 2013 10:46 AM
To: [email-masked]
Subject: [jose] Fwd: I-D Action: draft-miller-jose-pkix-key-00.txt

FYI...

- m&m

Begin forwarded message:

> Internet-Draft directories: http://www.ietf.org/shadow.html or 
> ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Brian Campbell <[email-masked]>
Date: Tue, 12 Feb 2013 16:58:49 -0700

"Abuse" is a strong word Tony.

On Tue, Feb 12, 2013 at 4:41 PM, Anthony Nadalin <[email-masked]>wrote:

> This seems to abuse JWK, as we are now looking at JWK to be just a bag and
> now its to hold a certificate or certificate chain which are much more that
> keys
>
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>

---

From: John Bradley <[email-masked]>
Date: Tue, 12 Feb 2013 23:27:21 -0300

Wether it is abuse depends on you perspective I suppose.

If only we could kill x509 and move on:)

Unfortunately that isn't going to happen any time soon.  There are a lot of tools out there for dealing with PEM encoded certificates.

One thing developers told us ion Connect was that even if they are dealing with raw keys it is easier for them to import self signed certs.

The problem we have is we have no way to provide a single key identifier for both x509 and JWK.

In SAML meta-data and even that other ancient WS metadata format someone named Tony may be responsible for there is a way to include a PEM encoded cert alongside a raw key representation.

Having a single document that can contain the raw key info along with the meta data and also reference a x509 format that some people may prefer for import has some attraction.

If you wanted to limit it to a single self signed pen encoded vert I could probably live with that, but others may want to validate the vert chain etc.

What we have now for treating JWK and x509 separately is a mess for developers to figure out.

In Connect I would like to have the server point to a single file that contains info about key identifiers, key use, perhaps expires, and the import information in raw and PEM.

Now I have to admit they Tony has a very small point in that we need to be clear on how conflicting info from the cert and JSON are treated.  However I don't think that is insurmountable.  
I do think it is better than what we have now where we have no way to roll over x509 keys and you have to publish each key in two completely separate ways.

So while it may be a bag it is I think a useful one.

John B.

On 2013-02-12, at 8:58 PM, Brian Campbell <[email-masked]> wrote:

> On Tue, Feb 12, 2013 at 4:41 PM, Anthony Nadalin <[email-masked]> wrote:

---

From: Anthony Nadalin <[email-masked]>
Date: Wed, 13 Feb 2013 03:05:44 +0000

Well it turns JWK into a bag that is no longer strictly holding keys. It now holds PEM encoded certificate chains

From: [email-masked] [mailto:[email-masked]] On Behalf Of Brian Campbell
Sent: Tuesday, February 12, 2013 3:59 PM
To: Anthony Nadalin
Cc: [email-masked]; Matt Miller (mamille2)
Subject: Re: [jose] I-D Action: draft-miller-jose-pkix-key-00.txt

On Tue, Feb 12, 2013 at 4:41 PM, Anthony Nadalin <[email-masked]<mailto:[email-masked]>> wrote:
This seems to abuse JWK, as we are now looking at JWK to be just a bag and now its to hold a certificate or certificate chain which are much more that keys

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Matt Miller (mamille2)
Sent: Tuesday, February 12, 2013 10:46 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [jose] Fwd: I-D Action: draft-miller-jose-pkix-key-00.txt

FYI...

- m&m

Matt Miller < [email-masked]<mailto:[email-masked]> >
Cisco Systems, Inc.

Begin forwarded message:

> From: <[email-masked]<mailto:[email-masked]>>
> To: <[email-masked]<mailto:[email-masked]>>
> Reply-To: <[email-masked]<mailto:[email-masked]>>
>
>
> [email-masked]<mailto:[email-masked]>

_______________________________________________
jose mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jose

---

From: Brian Campbell <[email-masked]>
Date: Wed, 13 Feb 2013 16:29:16 -0700

It's an extremely useful bag.

On Tue, Feb 12, 2013 at 8:05 PM, Anthony Nadalin <[email-masked]>wrote:

>  Well it turns JWK into a bag that is no longer strictly holding keys. It
> now holds PEM encoded certificate chains****
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *Brian Campbell
> *Sent:* Tuesday, February 12, 2013 3:59 PM
> *To:* Anthony Nadalin
> *Cc:* [email-masked]; Matt Miller (mamille2)
> *Subject:* Re: [jose] I-D Action: draft-miller-jose-pkix-key-00.txt****
>
> ** **
>
> "Abuse" is a strong word Tony. ****
>
> ** **
>
> On Tue, Feb 12, 2013 at 4:41 PM, Anthony Nadalin <[email-masked]>
> wrote:****
>
> keys****
> ****
> https://www.ietf.org/mailman/listinfo/jose****
>
>  ** **
>