Re: [jose] #15: Broken examples in JWE / JWS

This may or may not be a flaw in the specification.  However the item you
created in the tracker does not reflect what you have put here.  I think you
would be better served by saying that there is a flaw in the specifications
in that there should be a MUST that some type of key or key reference is
required in a JWS or JWE.

I would note that your example code should be more complex in that it does
not deal with jku or any of the x* methods of referencing keys.

Jim

From: Richard Barnes [mailto:rlb@ipv.sx] 
Sent: Friday, March 22, 2013 4:09 PM
To: Jim Schaad
Cc: draft-ietf-jose-json-web-encryption@tools.ietf.org; jose@ietf.org
Subject: Re: [jose] #15: Broken examples in JWE / JWS

I admit that they are not broken according to the current spec.  However, I
have a lot of trouble figuring out how I would write code to process them.

If "kid" or "jwk" MUST be present to indicate what key I should use, then I
can have deterministic code:

if (/* recognized "kid" or "jwk" value */) { 

    /* use it */

} else {

    /* FAIL.  can't process this object */

}

As the spec stands, I have no idea what to put in that "else" clause.  I'm
clearly not supposed to fail, because the parameters are optional.  But what
else?

if (/* recognized "kid" or "jwk" value */) { 

    /* use it */

} else {

    /* insert special magic here */

}

This is actually what SPI is supposed to clear up.  SPI would provide an
explicit third branch for the special magic to live in.

if (/* recognized "kid" or "jwk" value */) { 

    /* use it */

} else if (/* recognized SPI value */) {

    /* process using stored parameters */

} else {

    /* FAIL.  can't process this object */

}

But without the concept of SPI, the spec is broken because of the
non-determinism noted above.

--Richard

On Fri, Mar 22, 2013 at 6:13 PM, Jim Schaad <ietf@augustcellars.com> wrote:

My inclination is that this response is correct.

What make you think that the key or key reference is required and cannot be
implied?

Jim

> -----Original Message-----
> From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of
> jose issue tracker
> Sent: Friday, March 22, 2013 2:37 PM
> To: draft-ietf-jose-json-web-encryption@tools.ietf.org;
ignisvulpis@gmail.com
> Cc: jose@ietf.org
> Subject: Re: [jose] #15: Broken examples in JWE / JWS
>
> #15: Broken examples in JWE / JWS
>
>
> Comment (by ignisvulpis@gmail.com):
>
>  I think this is not an issue. The examples are NOT broken and they do not
> need a fix.
>  I suggest to close this ticket.
>  The draft should definitely not make these illegal. These objects are
perfect
> examples for a valid JWS/JWE.
>
> --
> -------------------------+----------------------------------------------

> -------------------------+---

>  Reporter:  rlb@ipv.sx   |       Owner:  draft-ietf-jose-json-web-
>      Type:  defect       |  encryption@tools.ietf.org
>  Priority:  minor        |      Status:  new
> Component:  json-web-    |   Milestone:
>   encryption             |     Version:
>  Severity:  -            |  Resolution:
>  Keywords:               |
> -------------------------+----------------------------------------------

> -------------------------+---

>
> Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/15#comment:1>
> jose <http://tools.ietf.org/jose/>
>
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose