Re: [CFRG] OCB does not have an OID specified, that is a general problem

Phillip Hallam-Baker <> Sat, 12 June 2021 03:52 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 9F1883A1BAC for <>; Fri, 11 Jun 2021 20:52:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.401
X-Spam-Status: No, score=-1.401 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.248, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id yoGN_Ec0t9uw for <>; Fri, 11 Jun 2021 20:52:54 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 514173A1BAE for <>; Fri, 11 Jun 2021 20:52:54 -0700 (PDT)
Received: by with SMTP id f84so7240111ybg.0 for <>; Fri, 11 Jun 2021 20:52:54 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cPQMhmndeSurZz02e5aIqLSF9L6+yazrn3Y1apcB924=; b=Y7s5XMVYnrHY6PyQ7WSlJN0WhfONkvBgteAfVFl5NVg8K7OW6urwo69fFIl6VVK9V5 PyjxxoK+pmLwUFDhyhL2AMFS9xF0iJB2O8v5/CyyFLcnsprnkoXCSactMZB86mXJubAh J/HH4Au0QgMcJYsttFkboJ3V2CgMXm6U7HNOjv0RU1V1gxq3+jtC0/aZ26Me/Je0aimx ZCjO5MuNuAL2t+fmmawH/PfNtojvTaj+bvFKZbOHZGgDtQ1iXrZ6X96v3veO6dppqUHb kUsUpXH0BzjyYGVIe3VhMWek2/4DhR90UD69WP/X9M6yxpxgPVkzalTKnxiJXXovmh5/ Zicw==
X-Gm-Message-State: AOAM533ayPqpYAK3wo28GlIpr06ZXlS4VE+mr0ky5xT1EwBYctYuHosa 9yQyeQklSXFndD88KxdYIzZqI+y1EOANORmbeTM=
X-Google-Smtp-Source: ABdhPJybJYAotYgKGh4TpLwrGcbD14vOXF6k0e2P08MbhfrTCZ06P0WSJDU6H2d6Ue9wcSlcUtP+jZEcEhpo1mLownk=
X-Received: by 2002:a25:660b:: with SMTP id a11mr10189838ybc.172.1623469972744; Fri, 11 Jun 2021 20:52:52 -0700 (PDT)
MIME-Version: 1.0
References: <> <> <> <>
In-Reply-To: <>
From: Phillip Hallam-Baker <>
Date: Fri, 11 Jun 2021 23:52:41 -0400
Message-ID: <>
To: Neil Madden <>
Content-Type: multipart/alternative; boundary="0000000000000770dc05c4898f3f"
Archived-At: <>
Subject: Re: [CFRG] OCB does not have an OID specified, that is a general problem
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 12 Jun 2021 03:52:59 -0000

On Fri, Jun 11, 2021 at 6:00 AM Neil Madden <> wrote:

> On 8 Jun 2021, at 17:36, Phillip Hallam-Baker <>
> wrote:
> Not at all. My point is that the purpose of a registry is limited to
> assigning a signifier to one or more signified. It is not for IANA to
> specify that RSA is required or not, that is a WG decision.
> And yet that is exactly what is recorded in the IANA JOSE registry. I
> appreciate that you’d like things to be different, but that’s not the
> reality today. A WG established the IANA registry and set up the procedures
> by which alterations to it are made, as described in RFC 7518 that
> established the registry (p34):

Yes, like I said. It was a mistake. There is no need to compound it.

> And merely assigning a code point does not change the recommendations for
> implementing algorithms in a 'JOSE Library'.
> It absolutely does in this case.

Only because there is a column giving the recommendation status. My point
is that is a mistake.

By your own admission the Mesh is doing something entirely non-standard
> with JOSE anyway, so you are also free to also adopt OCB as a non-standard
> algorithm.

It will become the standard if people use it. Which is precisely the point:
Code point registrations are properties of algorithms, not one particular
protocol that might use them. There should never have been a JOSE algorithm
registry in the first place, it should have been a registry of algorithms
that JOSE was merely the first consumer of.

I remember when the IANA Content Type Registry was the MIME Type. If MIME
had made recommendations for supported types, should those have been
binding on the Web?