Re: [jose] #15: Broken examples in JWE / JWS

I've renamed the issue to try to clarify.

You're right that there are alternative ways to locate a key.  But a JOSE
object needs to contain at least one of them, or else the /* special magic
*/ clause applies.

--Richard

On Fri, Mar 22, 2013 at 9:15 PM, Jim Schaad <ietf@augustcellars.com> wrote:

> This may or may not be a flaw in the specification.  However the item you
> created in the tracker does not reflect what you have put here.  I think
> you would be better served by saying that there is a flaw in the
> specifications in that there should be a MUST that some type of key or key
> reference is required in a JWS or JWE.****
>
> ** **
>
> I would note that your example code should be more complex in that it does
> not deal with jku or any of the x* methods of referencing keys.****
>
> ** **
>
> Jim****
>
> ** **
>
> ** **
>
> *From:* Richard Barnes [mailto:rlb@ipv.sx]
> *Sent:* Friday, March 22, 2013 4:09 PM
> *To:* Jim Schaad
> *Cc:* draft-ietf-jose-json-web-encryption@tools.ietf.org; jose@ietf.org
>
> *Subject:* Re: [jose] #15: Broken examples in JWE / JWS****
>
> ** **
>
> I admit that they are not broken according to the current spec.  However,
> I have a lot of trouble figuring out how I would write code to process them.
> ****
>
> ** **
>
> If "kid" or "jwk" MUST be present to indicate what key I should use, then
> I can have deterministic code:****
>
> if (/* recognized "kid" or "jwk" value */) { ****
>
>     /* use it */****
>
> } else {****
>
>     /* FAIL.  can't process this object */****
>
> }****
>
> ** **
>
> As the spec stands, I have no idea what to put in that "else" clause.  I'm
> clearly not supposed to fail, because the parameters are optional.  But
> what else?****
>
> if (/* recognized "kid" or "jwk" value */) { ****
>
>     /* use it */****
>
> } else {****
>
>     /* insert special magic here */****
>
> }****
>
> ** **
>
> This is actually what SPI is supposed to clear up.  SPI would provide an
> explicit third branch for the special magic to live in.****
>
> if (/* recognized "kid" or "jwk" value */) { ****
>
>     /* use it */****
>
> } else if (/* recognized SPI value */) {****
>
>     /* process using stored parameters */****
>
> } else {****
>
>     /* FAIL.  can't process this object */****
>
> }****
>
> ** **
>
> But without the concept of SPI, the spec is broken because of the
> non-determinism noted above.****
>
> ** **
>
> --Richard****
>
> ** **
>
> ** **
>
> ** **
>
> On Fri, Mar 22, 2013 at 6:13 PM, Jim Schaad <ietf@augustcellars.com>
> wrote:****
>
> My inclination is that this response is correct.
>
> What make you think that the key or key reference is required and cannot be
> implied?
>
> Jim****
>
>
>
> > -----Original Message-----
> > From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of
> > jose issue tracker
> > Sent: Friday, March 22, 2013 2:37 PM
> > To: draft-ietf-jose-json-web-encryption@tools.ietf.org;
> ignisvulpis@gmail.com
> > Cc: jose@ietf.org
> > Subject: Re: [jose] #15: Broken examples in JWE / JWS
> >
> > #15: Broken examples in JWE / JWS
> >
> >
> > Comment (by ignisvulpis@gmail.com):
> >
> >  I think this is not an issue. The examples are NOT broken and they do
> not
> > need a fix.
> >  I suggest to close this ticket.
> >  The draft should definitely not make these illegal. These objects are
> perfect
> > examples for a valid JWS/JWE.
> >
> > --
> > -------------------------+----------------------------------------------
> ****
>
> > -------------------------+---****
>
> >  Reporter:  rlb@ipv.sx   |       Owner:  draft-ietf-jose-json-web-
> >      Type:  defect       |  encryption@tools.ietf.org
> >  Priority:  minor        |      Status:  new
> > Component:  json-web-    |   Milestone:
> >   encryption             |     Version:
> >  Severity:  -            |  Resolution:
> >  Keywords:               |
> > -------------------------+----------------------------------------------
> ****
>
> > -------------------------+---****
>
> >
> > Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/15#comment:1
> >
> > jose <http://tools.ietf.org/jose/>
> >
> > _______________________________________________
> > jose mailing list
> > jose@ietf.org
> > https://www.ietf.org/mailman/listinfo/jose****
>
> ** **
>