Re: [jose] JWK member names, was: SECDIR review of draft-ietf-jose-json-web-key-31
Richard Barnes <rlb@ipv.sx> Wed, 17 September 2014 16:52 UTC
Return-Path: <rlb@ipv.sx>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E004E1A06B5 for <jose@ietfa.amsl.com>; Wed, 17 Sep 2014 09:52:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.977
X-Spam-Level:
X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=unavailable
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8kZLTn0uGooL for <jose@ietfa.amsl.com>; Wed, 17 Sep 2014 09:52:45 -0700 (PDT)
Received: from mail-la0-f41.google.com (mail-la0-f41.google.com [209.85.215.41]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD7841A06BF for <jose@ietf.org>; Wed, 17 Sep 2014 09:52:43 -0700 (PDT)
Received: by mail-la0-f41.google.com with SMTP id s18so2297977lam.0 for <jose@ietf.org>; Wed, 17 Sep 2014 09:52:41 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=P6gFYXyO6C8WRiFGAhX5qtD9re6V014jQJuyVuddsJw=; b=h25b09Xc9kVmH3AVeV3W7Csq5QUTRuS7VVvUxaStJPobUxDHE6N8gWar7QsgwDuIgO QiDyWB0ZFyDuk3r6Y0BDFwJOuX1hdyCXNIiVfkMmym/db5w24aUWUhl3gnWUSZz0xl5I s1eprIdbO+oCUd9pvZ8elvm4aVAf3VeMHrXpVhdBgihRQjjPgki/SUdQCUHkfVBF5lZg ilWiJuEUmPPSiAdY34NTiv5m3CEXZe/U2JsGo1Ue4fLUhin34RbCJxWEafC8jrLnOEg9 pwrzDMi1RFobjJ/AAg8+au0IzOBR32uC4JwPmaeqnTqLqYtCGxG4XGuIPImZpnh3H00f vx2g==
X-Gm-Message-State: ALoCoQnbYpUIyk8pnJxss0cshIcCEO4KaVJt+lW8XZYX6BhisY8hAqzLcLKzShmz2lj/1zXjcIVr
MIME-Version: 1.0
X-Received: by 10.152.234.76 with SMTP id uc12mr46079292lac.50.1410972761622; Wed, 17 Sep 2014 09:52:41 -0700 (PDT)
Received: by 10.25.159.84 with HTTP; Wed, 17 Sep 2014 09:52:41 -0700 (PDT)
In-Reply-To: <CAHBU6ivJ+mQZetWDDkRjP1nB+XOCLyXatq4k9bv4y7onAgu=ug@mail.gmail.com>
References: <CAHbuEH4Ccn2Z=8kEECzvgjmtshwsFoa-EH_NpkJPos7zirGeaQ@mail.gmail.com> <4E1F6AAD24975D4BA5B16804296739439AEC00DB@TK5EX14MBXC292.redmond.corp.microsoft.com> <5416FE10.3060608@bbn.com> <CAHBU6iu3GfsLCAint3z7risZUnVW4EK0WrGVW6Dv=gvppiHSxQ@mail.gmail.com> <4E1F6AAD24975D4BA5B16804296739439AECCCDD@TK5EX14MBXC292.redmond.corp.microsoft.com> <54173546.5000400@bbn.com> <CAHBU6ivb3BeEufcnJB+eSk8wgETMx+qzH3miE6Z1jtrQkXNR3w@mail.gmail.com> <4E1F6AAD24975D4BA5B16804296739439AECE40B@TK5EX14MBXC292.redmond.corp.microsoft.com> <54184EBA.3010109@bbn.com> <4E1F6AAD24975D4BA5B16804296739439AED1727@TK5EX14MBXC292.redmond.corp.microsoft.com> <5418987E.1060307@bbn.com> <CFD36394-E707-4D51-9689-DD8B1FD320D5@ve7jtb.com> <54199E11.1000809@bbn.com> <CAHBU6ivJ+mQZetWDDkRjP1nB+XOCLyXatq4k9bv4y7onAgu=ug@mail.gmail.com>
Date: Wed, 17 Sep 2014 12:52:41 -0400
Message-ID: <CAL02cgRrW7nSRiBRoUxGvgUN-cxhbRVbYbtZ=BUKVkDmfd8LEg@mail.gmail.com>
From: Richard Barnes <rlb@ipv.sx>
To: Tim Bray <tbray@textuality.com>
Content-Type: multipart/alternative; boundary="001a11340f123e9b22050345b214"
Archived-At: http://mailarchive.ietf.org/arch/msg/jose/1MJRB396nNC7KM0kiaPIYwkBrEU
Cc: "jose-chairs@tools.ietf.org" <jose-chairs@tools.ietf.org>, Stephen Kent <kent@bbn.com>, "secdir@ietf.org" <secdir@ietf.org>, "draft-ietf-jose-json-web-key.all@tools.ietf.org" <draft-ietf-jose-json-web-key.all@tools.ietf.org>, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>, Michael Jones <Michael.Jones@microsoft.com>, "jose@ietf.org" <jose@ietf.org>, John Bradley <ve7jtb@ve7jtb.com>
Subject: Re: [jose] JWK member names, was: SECDIR review of draft-ietf-jose-json-web-key-31
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 17 Sep 2014 16:52:47 -0000
People are going to use off-the-shelf JSON parsers because they're the obvious tool for the job. It seems like a general maxim that if we prohibit using the obvious tools without a really good reason (which I don't really see here), people are just going to ignore the prohibition. --Richard On Wed, Sep 17, 2014 at 12:42 PM, Tim Bray <tbray@textuality.com> wrote: > The chance of the JOSE working group moving the vast world of deployed > JSON infrastructure round to 0.00. Thus putting a MUST reject in here > would essentially say you can’t use well-debugged production software, and > would be a really bad idea. > > On the other hand, if JOSE specified that producers’ messages MUST conform > to I-JSON, and a couple other WGs climbed on that bandwagon, and the word > started to get around, I wouldn’t be surprised if a few of the popular JSON > implementations added an I-JSON mode. That would be a good thing and > lessen the attack surface of all JSON-based protocols (which these days, is > a whole lot of them). > > > > On Wed, Sep 17, 2014 at 7:43 AM, Stephen Kent <kent@bbn.com> wrote: > >> OK, now I have a clear answer to the question I posed earlier, i.e., this >> is a JSON parser problem, not specific to the JOSE-defined formats. >> >> I still believe it makes sense for the RFC(s) to mandate rejection of >> duplicates, >> as a way to "encourage" transition to better parsers, as others have >> noted. And >> I rely on Tero's judgement that the required changes are not onerous. >> >> Steve >> > > > > -- > - Tim Bray (If you’d like to send me a private message, see > https://keybase.io/timbray) > > _______________________________________________ > jose mailing list > jose@ietf.org > https://www.ietf.org/mailman/listinfo/jose > >
- [jose] JWK member names, was: SECDIR review of dr… Kathleen Moriarty
- Re: [jose] JWK member names, was: SECDIR review o… Mike Jones
- Re: [jose] JWK member names, was: SECDIR review o… Tim Bray
- Re: [jose] JWK member names, was: SECDIR review o… Mike Jones
- Re: [jose] JWK member names, was: SECDIR review o… Tim Bray
- Re: [jose] JWK member names, was: SECDIR review o… Tim Bray
- Re: [jose] JWK member names, was: SECDIR review o… Stephen Kent
- Re: [jose] JWK member names, was: SECDIR review o… Tim Bray
- Re: [jose] JWK member names, was: SECDIR review o… Mike Jones
- Re: [jose] JWK member names, was: SECDIR review o… Mike Jones
- Re: [jose] JWK member names, was: SECDIR review o… Stephen Kent
- Re: [jose] JWK member names, was: SECDIR review o… Stephen Kent
- Re: [jose] JWK member names, was: SECDIR review o… Tim Bray
- Re: [jose] JWK member names, was: SECDIR review o… John Bradley
- Re: [jose] JWK member names, was: SECDIR review o… Mike Jones
- Re: [jose] JWK member names, was: SECDIR review o… Tim Bray
- Re: [jose] JWK member names, was: SECDIR review o… Tim Bray
- Re: [jose] JWK member names, was: SECDIR review o… John Bradley
- Re: [jose] JWK member names, was: SECDIR review o… Jim Schaad
- Re: [jose] JWK member names, was: SECDIR review o… Stephen Kent
- Re: [jose] JWK member names, was: SECDIR review o… Stephen Kent
- Re: [jose] [secdir] JWK member names, was: SECDIR… John Bradley
- Re: [jose] [secdir] JWK member names, was: SECDIR… Tero Kivinen
- Re: [jose] JWK member names, was: SECDIR review o… Tim Bray
- Re: [jose] [secdir] JWK member names, was: SECDIR… Tim Bray
- Re: [jose] JWK member names, was: SECDIR review o… Mike Jones
- Re: [jose] JWK member names, was: SECDIR review o… Stephen Kent
- Re: [jose] JWK member names, was: SECDIR review o… John Bradley
- Re: [jose] JWK member names, was: SECDIR review o… Tim Bray
- Re: [jose] JWK member names, was: SECDIR review o… Stephen Kent
- Re: [jose] JWK member names, was: SECDIR review o… Tim Bray
- Re: [jose] JWK member names, was: SECDIR review o… Richard Barnes
- Re: [jose] JWK member names, was: SECDIR review o… Stephen Kent
- Re: [jose] [secdir] JWK member names, was: SECDIR… Tero Kivinen
- Re: [jose] [secdir] JWK member names, was: SECDIR… Richard Barnes
- Re: [jose] JWK member names, was: SECDIR review o… Mike Jones
- Re: [jose] JWK member names, was: SECDIR review o… Kathleen Moriarty