Re: [jose] Whether implementations must understand all JOSE header fields

[Dirkjan Ochtman <[e-mail]>]

On Wed, Dec 19, 2012 at 6:12 AM, Manger, James H
<[e-mail]> wrote:
> Lets ignore the process for now (IETF, IANA…), the issue is whether this
> style of extension is sensible: an extension that indicates a change of
> semantics by the presence of a new field. A style that the “MUST understand
> everything” rule encourages.
>
> My argument is that this style is too dangerous a way to indicate new
> semantics. When changing semantics (as “zip” does) it would be much better
> to change a field we are confident implementations will be looking at, as
> opposed to relying on them to notice a new field.

I fully agree with this.

I think the better style is somewhat like this: implementation MUST
use the value of the "alg" header to determine how to interpret the
contents. Any possible alg value may have different header fields that
are required to implement that algorithm. This may be too simplistic,
but it's much more in line with what implementors are prone to doing,
and closer to the expected semantics of JSON processing.

Cheers,

Dirkjan