Re: [jose] Ted Lemon's No Objection on draft-ietf-jose-json-web-signature-33: (with COMMENT)

"Jim Schaad" <ietf@augustcellars.com> Mon, 06 October 2014 21:14 UTC

From: Jim Schaad <ietf@augustcellars.com>
To: 'Mike Jones' <Michael.Jones@microsoft.com>, 'Ted Lemon' <ted.lemon@nominum.com>, 'The IESG' <iesg@ietf.org>
References: <20141002133559.13776.1044.idtracker@ietfa.amsl.com> <4E1F6AAD24975D4BA5B16804296739439BAF0C38@TK5EX14MBXC286.redmond.corp.microsoft.com>
In-Reply-To: <4E1F6AAD24975D4BA5B16804296739439BAF0C38@TK5EX14MBXC286.redmond.corp.microsoft.com>
Date: Mon, 06 Oct 2014 14:11:31 -0700
Message-ID: <00dc01cfe1aa$1ab89cb0$5029d610$@augustcellars.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Thread-Index: AQLLq58qVrjHsZvA8uflm5e/1J9zwgJTrZDkmhlfIgA=
Content-Language: en-us
Archived-At: http://mailarchive.ietf.org/arch/msg/jose/-2Rqtr-9OyelXylRAygcMZeAs3Q
Cc: jose-chairs@tools.ietf.org, jose@ietf.org, draft-ietf-jose-json-web-signature@tools.ietf.org
Subject: Re: [jose] Ted Lemon's No Objection on draft-ietf-jose-json-web-signature-33: (with COMMENT)
Precedence: list


> -----Original Message-----
> From: Mike Jones [mailto:Michael.Jones@microsoft.com]
> Sent: Monday, October 06, 2014 12:54 AM
> To: Ted Lemon; The IESG
> Cc: jose-chairs@tools.ietf.org; draft-ietf-jose-json-web-
> signature@tools.ietf.org; jose@ietf.org
> Subject: RE: Ted Lemon's No Objection on draft-ietf-jose-json-web-
> signature-33: (with COMMENT)
> 
> Thanks for the review, Ted.  I've added the working group to the thread so
> they're aware of your comments.
> 
> > -----Original Message-----
> > From: Ted Lemon [mailto:ted.lemon@nominum.com]
> > Sent: Thursday, October 02, 2014 6:36 AM
> > To: The IESG
> > Cc: jose-chairs@tools.ietf.org; draft-ietf-jose-json-web-
> > signature@tools.ietf.org
> > Subject: Ted Lemon's No Objection on draft-ietf-jose-json-web-signature-
> 33:
> > (with COMMENT)
> >
> > Ted Lemon has entered the following ballot position for
> > draft-ietf-jose-json-web-signature-33: No Objection
> >
> > When responding, please keep the subject line intact and reply to all
> > email addresses included in the To and CC lines. (Feel free to cut
> > this introductory paragraph, however.)
> >
> >
> > Please refer to
> > http://www.ietf.org/iesg/statement/discuss-criteria.html
> > for more information about IESG DISCUSS and COMMENT positions.
> >
> >
> > The document, along with other ballot positions, can be found here:
> > http://datatracker.ietf.org/doc/draft-ietf-jose-json-web-signature/
> >
> >
> >
> > ----------------------------------------------------------------------
> > COMMENT:
> > ----------------------------------------------------------------------
> >
> > This looks like an attack surface:
> >
> >    The Header Parameter names within the JOSE
> >    Header MUST be unique; recipients MUST either reject JWSs with
> >    duplicate Header Parameter names or use a JSON parser that returns
> >    only the lexically last duplicate member name, as specified in
> >    Section 15.12 (The JSON Object) of ECMAScript 5.1 [ECMAScript].
> >
> > Is this really safe?
> 
> Quoting Kathleen's response on the thread so the working group will see it:
> "I pointed to a thread on this in the ballot text, so thanks for weighing in.  This
> has been a hot discussion in the WG and is unresolved as to how it should be
> handled.  This discussion seems to be happening on Pete's Abstain, so let's
> see if we can keep it there for now and this as a placeholder.  It comes down
> to implementation issues and a decision as to how we should best handle it.
> Thanks."

Jim says it is not safe, but he has been unable to convince anybody of this fact.

> Thanks.  A lot of smart and knowledgeable people have contributed to it.
> Thanks for your contributions as well.
> 
> 				-- Mike
>

Re: [jose] Ted Lemon's No Objection on draft-ietf… Mike Jones
Re: [jose] Ted Lemon's No Objection on draft-ietf… Jim Schaad
Re: [jose] Ted Lemon's No Objection on draft-ietf… Mike Jones