[jose] Re: 2nd WGLC for draft-ietf-jose-fully-specified-algorithms (Fully Specified Algorithms)

[Michael Jones <[e-mail]>]

Thanks for your comments, Göran.  See the updates to the specification in https://www.ietf.org/archive/id/draft-ietf-jose-fully-specified-algorithms-06.html.  My replies are inline below, prefixed by "Mike>".

                                                                -- Mike

From: Göran Selander <goran.selander=[e-mail]>
Sent: Thursday, September 5, 2024 1:30 AM
To: [e-mail]; [e-mail]
Subject: [jose] Re: 2nd WGLC for draft-ietf-jose-fully-specified-algorithms (Fully Specified Algorithms)

(About target audience:  This draft is proposing to deprecate algorithms in the COSE IANA registry. It would be great if it by default was circulated also on the COSE WG mailing list to enable a timely discussion among those affected.)

Mike> Agreed

With reference to a previous thread on this topic:
https://www.mail-archive.com/[e-mail]/msg03799.html
The term "deprecated" is still used in this draft with a different meaning compared to RFC8996 and RFC9325. It doesn't help that you in this document point out that you are using the word with a different meaning that people are used to, very much fewer people will read this document than those that stumble on the term used in registries and understand it from other contexts.

Moreover, this overload of terminology is actually  unnecessary:

Section 4.4
> The terms "Deprecated" and "Prohibited" as used by JOSE and COSE registrations are currently undefined.

So, in fact this provides a unique opportunity to disambiguate and avoid the otherwise inevitable confusion that will come up over and over again arising from the use of the same term with different meanings. A number of perfectly good alternative terms were suggested in the referenced mail thread.

Mike> Yes, there were not definitions of "Deprecated" and "Prohibited" previously in the specifications, but I will observe that the use of both terms in RFC 7518 makes the distinction pretty clear in context based on the plain English meanings of the terms.  "Prohibited" means that an algorithm must not be used.  "Deprecated" means that an alternative algorithm should be used, when possible.  The specification clearly and consistently defines both of those terms in a way that's applicable to both JOSE and COSE.

Mike> Furthermore, and I consider this a big plus. these definitions don't require any changes to existing JOSE or COSE registrations.  Nor do they require defining new terms that were not already in use.  Many of the other terminology proposals don't share these advantages, which is why we went with this one.  I'll also observe that some reviewers explicitly thanked us for the clear terminology definitions.

Moreover, for systems that makes use of the COSE IANA registry and specifies algorithms with enough parameters to make them completely determined, for example EDHOC cipher suites, there is no need to change or abandon the use of the current algorithms. Hence the recommendation ("SHOULD") in the definition does not apply to such systems, and that circumstance should be stated as an exception to the recommendation.

Mike> We added text describing circumstances in which it makes sense to continue using deprecated algorithms, per your suggestion.

In summary


  *   use a different term
  *   make it clear that current algorithms may be used in case a separate specification adds the necessary information to make them fully specified


Göran


From: John Mattsson <john.mattsson=[e-mail]<mailto:john.mattsson=[e-mail]>>
Date: Thursday, 22 August 2024 at 11:10
To: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>
Subject: [COSE] FW: [jose] 2nd WGLC for draft-ietf-jose-fully-specified-algorithms (Fully Specified Algorithms)
Forwarding to the COSE list as the document updates both RFC 8152 and RFC 9053.

Cheers,
John

From: Karen ODonoghue <[e-mail]<mailto:[e-mail]>>
Date: Wednesday, 21 August 2024 at 16:12
To: JOSE WG <[e-mail]<mailto:[e-mail]>>
Subject: [jose] 2nd WGLC for draft-ietf-jose-fully-specified-algorithms (Fully Specified Algorithms)
JOSE working group members,

This email initiates a second working group last call for the Fully
Specified Algorithms document:
https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-jose-fully-specified-algorithms%2F&data=05%7C02%7Cjohn.mattsson%40ericsson.com%7C4d5ca1448df945ce272908dcc1eb446e%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C638598463418037480%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=lC1d%2Bvw9fTh%2FG2brNNztghIYFbp4pnGwjqvfN%2Bbqrn8%3D&reserved=0<https://datatracker.ietf.org/doc/draft-ietf-jose-fully-specified-algorithms/>

The authors have updated the draft based on WGLC comments and
discussions at IETF 120, and the chairs have polled the working group
about the readiness for WGLC. Seeing no opposition, we've decided to
proceed with a second WGLC.

Please review the document in detail and reply to this message
(keeping the subject line intact) with your opinion on the readiness
of this document for publication and any additional comments that you
have.

This will be a three week WGLC. Please submit your responses by 13
September 2024.

Thank you,
Karen (for the JOSE WG chairs)

_______________________________________________
jose mailing list -- [e-mail]<mailto:[e-mail]>
To unsubscribe send an email to [e-mail]<mailto:[e-mail]>