Subject: [jose] Issue #187 - Allow registration of non-JWE/JWS algorithms for JWK

From: "Jim Schaad" <[email-masked]>
Date: Fri, 13 Dec 2013 17:00:57 -0800

Minor question before I close this bug.  

Is there any sentiment to use a term that is not quite as "nasty" as
"Prohibited" in the registration record.   Specifically something along the
lines of "Key Transport Only".

Jim

---

From: Mark Watson <[email-masked]>
Date: Fri, 13 Dec 2013 17:43:22 -0800

Yes, I think it would be clearer to change or quality the term. "JWK only"
or "Key Transport Only" or "Prohibited for JWE/JWS" could all work.

FYI, the WebCrypto registrations are not in the Editor's Draft at
https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html,
though there remains the question of whether we could register an Array
format instead of a string for JWK, as per my earlier mail (comments
please!).

...Mark

On Fri, Dec 13, 2013 at 5:00 PM, Jim Schaad <[email-masked]> wrote:

> Is there any sentiment to use a term that is not quite as “nasty” as
> “Prohibited” in the registration record.   Specifically something along the
> lines of “Key Transport Only”.
>
>
>
> Jim
>
>
>
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>
>

---

From: Mike Jones <[email-masked]>
Date: Sat, 14 Dec 2013 04:53:35 +0000

The meaning of "Prohibited" is already clear.  http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-18#section-7.1.1 says:
      Any identifiers registered for non-authenticated encryption algorithms
      or other algorithms that are otherwise unsuitable for direct use
      as JWS or JWE algorithms must be registered as "Prohibited".

I don't think a change is needed.

                                                            -- Mike

From: jose [mailto:[email-masked]] On Behalf Of Mark Watson
Sent: Friday, December 13, 2013 5:43 PM
To: Jim Schaad
Cc: [email-masked]
Subject: Re: [jose] Issue #187 - Allow registration of non-JWE/JWS algorithms for JWK

Yes, I think it would be clearer to change or quality the term. "JWK only" or "Key Transport Only" or "Prohibited for JWE/JWS" could all work.

FYI, the WebCrypto registrations are not in the Editor's Draft at https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html, though there remains the question of whether we could register an Array format instead of a string for JWK, as per my earlier mail (comments please!).

...Mark

On Fri, Dec 13, 2013 at 5:00 PM, Jim Schaad <[email-masked]<mailto:[email-masked]>> wrote:
Minor question before I close this bug.

Is there any sentiment to use a term that is not quite as "nasty" as "Prohibited" in the registration record.   Specifically something along the lines of "Key Transport Only".

Jim

_______________________________________________
jose mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jose

---

From: Karen O'Donoghue <[email-masked]>
Date: Wed, 18 Dec 2013 16:42:41 -0500

True, but, is there any harm in making the term clearer as well? I don't 
see one...

Karen

On 12/13/13 11:53 PM, Mike Jones wrote:
>
> The meaning of "Prohibited" is already clear. 
> http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-18#section-7.1.1 
> says:
>
> *From:*jose [mailto:[email-masked]] *On Behalf Of *Mark Watson
> *Sent:* Friday, December 13, 2013 5:43 PM
> *To:* Jim Schaad
> *Cc:* [email-masked]
> *Subject:* Re: [jose] Issue #187 - Allow registration of non-JWE/JWS 
> algorithms for JWK
>
> Yes, I think it would be clearer to change or quality the term. "JWK 
> only" or "Key Transport Only" or "Prohibited for JWE/JWS" could all work.
>
> though there remains the question of whether we could register an 
> Array format instead of a string for JWK, as per my earlier mail 
> (comments please!).
>
> ...Mark
>
> "Prohibited" in the registration record. Specifically something along 
> the lines of "Key Transport Only".
>
> Jim
>
>
> [email-masked] <mailto:[email-masked]>

---

From: Richard Barnes <[email-masked]>
Date: Wed, 18 Dec 2013 18:41:37 -0500

I'm with Jim and Karen on this one.

On Wed, Dec 18, 2013 at 4:42 PM, Karen O'Donoghue <[email-masked]>wrote:

>  The meaning of “Prohibited” is already clear.
> http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-18#section-7.1.1says:
>
> I don’t think a change is needed.
>
>
>
>                                                             -- Mike
>
>
>
> *From:* jose [mailto:[email-masked] <[email-masked]>] *On
> Behalf Of *Mark Watson
> jose mailing [email-masked]://www.ietf.org/mailman/listinfo/jose
>
>
>

---

From: Mike Jones <[email-masked]>
Date: Thu, 19 Dec 2013 08:01:34 +0000

I guess my problem with changing "Prohibited" to "Prohibited for JWS and JWE" is that then to be parallel we'd need to change "Required" to one of "Required for JWS", "Required for JWE", or "Required for JWS and JWE", depending up context, change "Recommended"..., change "Optional"..., change "Deprecated"..., etc.  It wouldn't change the meaning at all and it would add a lot of unnecessary verbal clutter.

This wouldn't just affect "Prohibited".

I'd much rather handle this a different way, and change the registry field name from "Implementation Requirements" to "JOSE Implementation Requirements", rather than qualifying every registry field value in a complicated way - that is, if people really believe that a change would be an improvement.

                                                            -- Mike

From: jose [mailto:[email-masked]] On Behalf Of Richard Barnes
Sent: Wednesday, December 18, 2013 3:42 PM
To: Karen ODonoghue
Cc: [email-masked]
Subject: Re: [jose] Issue #187 - Allow registration of non-JWE/JWS algorithms for JWK

On Wed, Dec 18, 2013 at 4:42 PM, Karen O'Donoghue <[email-masked]<mailto:[email-masked]>> wrote:
True, but, is there any harm in making the term clearer as well? I don't see one...

Karen

                                                            -- Mike

From: jose [mailto:[email-masked]] On Behalf Of Mark Watson
Sent: Friday, December 13, 2013 5:43 PM
To: Jim Schaad
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [jose] Issue #187 - Allow registration of non-JWE/JWS algorithms for JWK

...Mark

Jim

jose mailing list

---

From: "Jim Schaad" <[email-masked]>
Date: Thu, 19 Dec 2013 11:43:50 -0800

Mike,

I had offered a number of possibilities, do you see the same rewrite for all
of them? 

If we do the JOSE Implementation Requirements, what does this mean in terms
of what you would do for the keying only algorithms?

Jim

From: jose [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Thursday, December 19, 2013 12:02 AM
To: Richard Barnes; Karen ODonoghue
Cc: [email-masked]
Subject: Re: [jose] Issue #187 - Allow registration of non-JWE/JWS
algorithms for JWK

I guess my problem with changing "Prohibited" to "Prohibited for JWS and
JWE" is that then to be parallel we'd need to change "Required" to one of
"Required for JWS", "Required for JWE", or "Required for JWS and JWE",
depending up context, change "Recommended"., change "Optional"., change
"Deprecated"., etc.  It wouldn't change the meaning at all and it would add
a lot of unnecessary verbal clutter.

I'd much rather handle this a different way, and change the registry field
name from "Implementation Requirements" to "JOSE Implementation
Requirements", rather than qualifying every registry field value in a
complicated way - that is, if people really believe that a change would be
an improvement.

                                                            -- Mike

From: jose [mailto:[email-masked]] On Behalf Of Richard Barnes
Sent: Wednesday, December 18, 2013 3:42 PM
To: Karen ODonoghue
Cc: [email-masked]
Subject: Re: [jose] Issue #187 - Allow registration of non-JWE/JWS
algorithms for JWK

On Wed, Dec 18, 2013 at 4:42 PM, Karen O'Donoghue <[email-masked]>
wrote:

True, but, is there any harm in making the term clearer as well? I don't see
one...

Karen

The meaning of "Prohibited" is already clear.
http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-18#section-7.
1.1 says:

                                                            -- Mike

From: jose [mailto:[email-masked]] On Behalf Of Mark Watson
Sent: Friday, December 13, 2013 5:43 PM
To: Jim Schaad
Cc: [email-masked]
Subject: Re: [jose] Issue #187 - Allow registration of non-JWE/JWS
algorithms for JWK

FYI, the WebCrypto registrations are not in the Editor's Draft at
https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html, though
there remains the question of whether we could register an Array format
instead of a string for JWK, as per my earlier mail (comments please!).

...Mark

Jim