Re: [Gen-art] Gen-Art LC review: draft-ietf-jose-jws-signing-input-options-06

Robert Sparks <> Sun, 13 December 2015 21:11 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 581571A6FC2; Sun, 13 Dec 2015 13:11:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Kub824tc8gRD; Sun, 13 Dec 2015 13:11:38 -0800 (PST)
Received: from ( [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id C3D8E1A6FBA; Sun, 13 Dec 2015 13:11:37 -0800 (PST)
Received: from unnumerable.local ( []) (authenticated bits=0) by (8.15.2/8.14.9) with ESMTPSA id tBDLBZqm069473 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=OK); Sun, 13 Dec 2015 15:11:35 -0600 (CST) (envelope-from
X-Authentication-Warning: Host [] claimed to be unnumerable.local
To: Mike Jones <>, General Area Review Team <>, "" <>, "" <>, "" <>
References: <> <>
From: Robert Sparks <>
Message-ID: <>
Date: Sun, 13 Dec 2015 15:11:29 -0600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Thunderbird/38.4.0
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: <>
Subject: Re: [Gen-art] Gen-Art LC review: draft-ietf-jose-jws-signing-input-options-06
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "GEN-ART: General Area Review Team" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 13 Dec 2015 21:11:39 -0000

Cutting away a bit to focus on the question:

On 12/12/15 8:32 PM, Mike Jones wrote:
> Hi Robert.  Thanks for the useful review.  Replies are inline below...
>> -----Original Message-----
>> I would have been much more comfortable with a consensus to require 'crit'.
>> (Count me in the rough if this proceeds with crit being optional).
>> I assume there is a strong reason to allow for option 1. Please add the
>> motivation for it to the draft, and consider adding a SHOULD use 'crit'
>> requirement if option 1 remains.
> It's a reasonable request to have the draft say why "crit" isn't required.  My working draft adds the following new paragraph at the end of the security considerations section to do this.  Unless I hear objections, I'll plan on publishing an updated draft with the paragraph shortly.
> "Note that methods 2 and 3 are sufficient to cause JWSs using this extension to be rejected by implementations not supporting this extension but they are not sufficient to enable JWSs using this extension to be successfully used by applications.
The conclusion you draw here is not at all obvious.
_WHY_ is crit not sufficient? I think that's the thing that's missing as 

>   Thus, method 1 - requiring support for this extension - is the preferred approach and the only means for this extension to be practically useful to applications. Method 2 - requiring the use of <spanx style="verb">crit</spanx> - while theoretically useful to ensure that confusion between encoded and unencoded payloads cannot occur, is not particularly useful in practice, since method 1 is still required for the extension to be usable. When method 1 is employed, method 2 doesn't add any value and since it increases the size of the JWS, its use is not required by this specification."
>> Nits/editorial comments:
>> In the security considerations, the last sentence of the first paragraph needs
>> to be simplified. I suggest replacing it with:
>> "It then becomes the responsibility of the application to ensure that payloads
>> only contain characters that will not cause parsing problems for the
>> serialization used, as described in Section 5. The application also incurs the
>> responsibility to ensure that the payload will not be modified during
>> retransmission.
> I have simplified this in the manner that you suggested.
> 				Thanks again,
> 				-- Mike