Re: [jose] #27: member names MUST be unique needs additional text

"Manger, James H" <James.H.Manger@team.telstra.com> Thu, 27 June 2013 05:39 UTC

From: "Manger, James H" <James.H.Manger@team.telstra.com>
To: Tim Bray <tbray@textuality.com>, Mike Jones <Michael.Jones@microsoft.com>
Date: Thu, 27 Jun 2013 15:39:05 +1000
Thread-Topic: [jose] #27: member names MUST be unique needs additional text
Thread-Index: Ac5y9omnN2qpgs6iQLe4JDlwlLM0cgAAK0zw
Message-ID: <255B9BB34FB7D647A506DC292726F6E1151BE45737@WSMSG3153V.srv.dir.telstra.com>
References: <061.bb7bbe0b618ec6b74904f48bdb9bb312@trac.tools.ietf.org> <076.a597050ecb4fb25084cec65f7174dc7e@trac.tools.ietf.org> <033b01ce729b$26ff5c90$74fe15b0$@augustcellars.com> <4E1F6AAD24975D4BA5B16804296739436789B4CC@TK5EX14MBXC283.redmond.corp.microsoft.com> <03b401ce72e5$002c65f0$008531d0$@augustcellars.com> <4E1F6AAD24975D4BA5B16804296739436789D4EA@TK5EX14MBXC283.redmond.corp.microsoft.com> <CAHBU6ivNow2xhDvRj7gG2gmHQ+C-ejEHCQubK=LwUtrXxdW6MA@mail.gmail.com>
In-Reply-To: <CAHBU6ivNow2xhDvRj7gG2gmHQ+C-ejEHCQubK=LwUtrXxdW6MA@mail.gmail.com>
Accept-Language: en-US, en-AU
Content-Language: en-US
acceptlanguage: en-US, en-AU
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Cc: Jim Schaad <ietf@augustcellars.com>, "jose@ietf.org" <jose@ietf.org>, "draft-ietf-jose-json-web-signature@tools.ietf.org" <draft-ietf-jose-json-web-signature@tools.ietf.org>
Subject: Re: [jose] #27: member names MUST be unique needs additional text
Precedence: list

> I think it’s a nice clean minimal solution to say that producers MUST
> NOT generate dupes, end of story.  I don’t think saying anything beyond
> that adds value. -T

Clean and minimal that may be, but it ignores the security issue. We don't want a malicious producer (who is so malicious they ignore a MUST) to create JOSE messages that a JOSE-compliant security layer accepts as "benign interpretation #1" so it passes the message on to the JOSE-compliant backend app that acts on "nasty interpretation #2".

--
James Manger

[jose] #27: member names MUST be unique needs add… jose issue tracker
Re: [jose] #27: member names MUST be unique needs… jose issue tracker
Re: [jose] #27: member names MUST be unique needs… Jim Schaad
Re: [jose] #27: member names MUST be unique needs… Mike Jones
Re: [jose] #27: member names MUST be unique needs… Jim Schaad
Re: [jose] #27: member names MUST be unique needs… Mike Jones
Re: [jose] #27: member names MUST be unique needs… Tim Bray
Re: [jose] #27: member names MUST be unique needs… Manger, James H
Re: [jose] #27: member names MUST be unique needs… Manger, James H
Re: [jose] #27: member names MUST be unique needs… Tim Bray
Re: [jose] #27: member names MUST be unique needs… Manger, James H
Re: [jose] #27: member names MUST be unique needs… Carsten Bormann
Re: [jose] #27: member names MUST be unique needs… Manger, James H
Re: [jose] #27: member names MUST be unique needs… Tim Bray
Re: [jose] #27: member names MUST be unique needs… John Bradley
Re: [jose] #27: member names MUST be unique needs… Mike Jones
Re: [jose] #27: member names MUST be unique needs… Jim Schaad
Re: [jose] #27: member names MUST be unique needs… Jim Schaad
Re: [jose] #27: member names MUST be unique needs… Jim Schaad
Re: [jose] #27: member names MUST be unique needs… Richard Barnes
Re: [jose] #27: member names MUST be unique needs… Richard Barnes
Re: [jose] #27: member names MUST be unique needs… Mike Jones
Re: [jose] #27: member names MUST be unique needs… Mike Jones
Re: [jose] #27: member names MUST be unique needs… Richard Barnes
Re: [jose] #27: member names MUST be unique needs… Mike Jones
Re: [jose] #27: member names MUST be unique needs… jose issue tracker