Re: [jose] Stephen Farrell's Discuss on draft-ietf-jose-json-web-key-33: (with DISCUSS and COMMENT)

Mike Jones <> Mon, 06 October 2014 07:54 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 888831A1B6A; Mon, 6 Oct 2014 00:54:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id dvlNfaR54dJt; Mon, 6 Oct 2014 00:54:52 -0700 (PDT)
Received: from ( []) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 999551A1B72; Mon, 6 Oct 2014 00:54:49 -0700 (PDT)
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.1044.10; Mon, 6 Oct 2014 07:54:47 +0000
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.1044.10 via Frontend Transport; Mon, 6 Oct 2014 07:54:47 +0000
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.1039.16 via Frontend Transport; Mon, 6 Oct 2014 07:54:46 +0000
Received: from ([]) by ([]) with mapi id 14.03.0210.003; Mon, 6 Oct 2014 07:54:12 +0000
From: Mike Jones <>
To: Stephen Farrell <>, The IESG <>
Thread-Topic: Stephen Farrell's Discuss on draft-ietf-jose-json-web-key-33: (with DISCUSS and COMMENT)
Thread-Index: AQHP3jI0y2YQdh1++ku2NamIZ5KlrpwiPARQ
Date: Mon, 06 Oct 2014 07:54:11 +0000
Message-ID: <>
References: <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-originating-ip: []
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-EOPAttributedMessage: 0
X-Forefront-Antispam-Report: CIP:; CTRY:US; IPV:CAL; IPV:NLI; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(438002)(43784003)(377454003)(13464003)(199003)(189002)(52044002)(51704005)(120916001)(104016003)(50986999)(19580395003)(19580405001)(107046002)(69596002)(6806004)(15975445006)(10300001)(44976005)(76176999)(99396003)(68736004)(92726001)(84676001)(85806002)(54356999)(55846006)(64706001)(86362001)(46102003)(26826002)(92566001)(33656002)(47776003)(15202345003)(20776003)(230783001)(85852003)(66066001)(23676002)(50466002)(95666004)(2656002)(106116001)(31966008)(85306004)(77096002)(86612001)(80022003)(106466001)(4396001)(87936001)(97736003)(81156004)(76482002)(21056001); DIR:OUT; SFP:1102; SCL:1; SRVR:BLUPR03MB601;; FPR:; MLV:ovrnspm; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en;
X-Microsoft-Antispam: UriScan:;
X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;SRVR:BLUPR03MB601;
X-O365ENT-EOP-Header: Message processed by - O365_ENT: Allow from ranges (Engineering ONLY)
X-Exchange-Antispam-Report-Test: UriScan:;
X-Forefront-PRVS: 03569407CC
Received-SPF: Pass ( domain of designates as permitted sender); client-ip=;;
Authentication-Results: spf=pass (sender IP is;
Cc: "" <>, "" <>, "" <>
Subject: Re: [jose] Stephen Farrell's Discuss on draft-ietf-jose-json-web-key-33: (with DISCUSS and COMMENT)
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Javascript Object Signing and Encryption <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 06 Oct 2014 07:54:57 -0000

Thanks for your review, Stephen.  I'm adding the working group to the thread so they're aware of your comments.

> -----Original Message-----
> From: Stephen Farrell []
> Sent: Thursday, October 02, 2014 4:15 AM
> To: The IESG
> Cc:;
> Subject: Stephen Farrell's Discuss on draft-ietf-jose-json-web-key-33: (with
> Stephen Farrell has entered the following ballot position for
> draft-ietf-jose-json-web-key-33: Discuss
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> Please refer to
> for more information about IESG DISCUSS and COMMENT positions.
> The document, along with other ballot positions, can be found here:
> ----------------------------------------------------------------------
> ----------------------------------------------------------------------
> nearly a nit, but would impact code so a discuss to make sure we get it right...
> 4.5: saying kid is case sensitive precludes use of DNS names there or introduces
> bugs if those are used.  Since DNS names are the primary way we distinguish
> things on the Internet, that seems odd. I don't think that you need to say case-
> insensitive here but that you might want to say that DNS names SHOULD be
> [lower|upper]cased before being used in kid parameters.


> ----------------------------------------------------------------------
> ----------------------------------------------------------------------
> 4.8: I'd prefer if sha-256 had been the default/shorter of these. But whatever.

The SHA-1 is the one that's actually in widely deployed crypto libraries, including Windows and OpenSSL, and has been in the spec pretty much the whole time.  Kathleen had us add the S256 version based on its usage in SSH during her AD review.

> 4.8/4.9: the disconnect with DANE and other specs that use
> HASH(SPKI) as a thumbprint is a pity (but can be fixed later). How'd that happen?

The current thumbprint calculation is the one used by OpenSSL and Windows, among others.

The first that this issue was raised was during Tero Kivinen's secdir review.  In that discussion, I pointed out that other specs are free to define header parameter(s) to represent the HASH(SPKI) thumbprint and register them.  (I even pointed him to draft-jones-jose-jwk-thumbprint-01 as an example of a spec making a similar registration that he could use as an example if he wanted to write it up.)  He thought that that definition would be useful to the IoT community, so I expect that someone will do that when the need arises.

> 8: "make sense" still isn't useful;-) I've noted that on the algs draft though so
> won't repeat more.


> C.9: Huh? Needs a ref to compact rep which isn't defined here.

Agreed - thanks

> As with other JOSE drafts, there was a substantial thread on the secdir review
> that I didn't have time to follow but I'm ok that Kathleen's been on top of that.

Yes, she has.

				Thanks again,
				-- Mike