From: Mike Jones <Michael.Jones@microsoft.com>
To: Fraser Tweedale <frase@frase.id.au>,
 "draft-ietf-jose-json-web-signature@tools.ietf.org"
 <draft-ietf-jose-json-web-signature@tools.ietf.org>, "jose@ietf.org"
 <jose@ietf.org>
Thread-Topic: draft-ietf-jose-json-web-signature ; flattened serialization
Thread-Index: AQHP8y5fIRbO5Va9Y0STZ0rwvdUYypxGeatg
Date: Wed, 29 Oct 2014 04:25:32 +0000
Message-ID: <4E1F6AAD24975D4BA5B16804296739439BB2FE2B@TK5EX14MBXC286.redmond.corp.microsoft.com>
References: <20141029041043.GC55748@bacardi.hollandpark.frase.id.au>
In-Reply-To: <20141029041043.GC55748@bacardi.hollandpark.frase.id.au>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Received-SPF: Pass (protection.outlook.com: domain of microsoft.com designates
 131.107.125.37 as permitted sender)
 receiver=protection.outlook.com; 
 client-ip=131.107.125.37; helo=mail.microsoft.com;
Archived-At: http://mailarchive.ietf.org/arch/msg/jose/3VATzNcbLMW-d_ypPMsngeI5Kc8
Cc: Richard Barnes <rlb@ipv.sx>
Subject: Re: [jose] draft-ietf-jose-json-web-signature ;
 flattened serialization
Precedence: list

Thank you for your feedback, Fraser.  It would be useful to hear from other=
s who have implemented the JSON Serializations whether they agree with Fras=
er or Richard.

				-- Mike

P.S.  The list you sent it to reached the editors and chairs.  The jose@iet=
f.org list reaches the whole JOSE working group.

-----Original Message-----
From: Fraser Tweedale [mailto:frase@frase.id.au]=20
Sent: Tuesday, October 28, 2014 9:11 PM
To: draft-ietf-jose-json-web-signature@tools.ietf.org
Subject: draft-ietf-jose-json-web-signature ; flattened serialization

Hello,

(I am not familiar with IETF WG processes so I hope I am communicating in a=
 useful way and in the right place.)

JWS draft 36 adds a "flattened JWS syntax" for the case where there is a si=
ngle signature.  A similar change was made for JWE in the single recipient =
case.

Richard Barnes proposed these changes on the following basis:

    ``I've had several implementors trying to use JWS in the JSON
    serialization ask why it was necessary to include a "signatures"
    array in cases where there's only one signer.  It seems like this is
    going to be a major barrier to deployment and re-use.''

I am the author of a Haskell JOSE library
(http://hackage.haskell.org/package/jose) and object to these changes on th=
e following bases:

- They add substantial complexity to the parsing of JWS and JWE
  objects (which is already complex).

- The nature of the "optimisation" for the single-signature case is
  unclear.  If the optimisation is for compactness, this is obviated
  by "7.2. JWE JSON Serialization" which states ``This
  representation is neither optimized for compactness nor
  URL-safe.''  If the optimisation is for simplicity, it is a false
  economy.

- The fact that implementors were asking about this part of the spec
  does not imply an impediment to deployment and re-use.  (Perhaps
  comments to this effect were in fact made, but as written the
  justification is speculative.)

The wish for a "simpler" serialization for a common use case is understanda=
ble, but this is a case of "be careful what you wish for".  Commentary to t=
he effect of "the signatures array is used even when there is a single sign=
ature/recipient to keep parsing as simple as possible" would give implement=
ors the answer to this question and relieve them of the additional complexi=
ty required to support the Flattened Serialization in addition to the Gener=
al Serialization.

Please consider reverting this recent change to the specification.

Regards,

Fraser Tweedale