Re: [jose] Comments on draft-barnes-jose-spi-00

"kid" identifies a key.  "spi" identifies anything/everything.

Think of it this way:
"spi" --> { "alg", "enc", "zip", "kid", ... }

On Tue, Apr 2, 2013 at 1:41 PM, Hannes Tschofenig <hannes.tschofenig@gmx.net
> wrote:

> I don't understand why you need an additional spi parameter when there is
> already a kid parameter, which serves the same purpose.
>
> Here is the kid parameter in the JWE:
> http://tools.ietf.org/html/**draft-ietf-jose-json-web-**
> encryption-08#section-4.1.10<http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-08#section-4.1.10>
>
> Here is the kid parameter in the JWS:
> http://tools.ietf.org/html/**draft-ietf-jose-json-web-**
> signature-08#section-4.1.7<http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-08#section-4.1.7>
>
> Ciao
> Hannes
>
>
> On 04/02/2013 06:58 PM, Jim Schaad wrote:
>
>> Richard,
>>
>> There is not yet sufficient detail in this document for me to do a
>> proper evaluation of how things are going to work.  Example questions
>> that I have.
>>
>> 1. What headers are required and which can  be implicit – for example
>> can the algorithm fields be implicit in the SPI?
>>
>> 2.Are the integrity value computed across the fully populated header or
>> the SPI header?
>>
>> 3.Is there a way to forward a message from person A which knows the SPI
>>
>> values and person B which does not?
>>
>> 4.What is the correct algorithm for determining the JWS vs JWE in the
>>
>> event that all of the algorithms are implicit
>>
>> 5.What happens if you have implicit parameters and explicit parameters
>>
>> and they do not match?
>>
>> 6.Is there a recommended way to determine what the SPI parameters are
>>
>> going to be?  Does the application need to pre-parse the message to get
>> the SPI value or is there a recommendation that some type of callback be
>> included
>>
>> 7.Can you make things like the IV be implicit?  Thus agree on a starting
>>
>> value and an increment and compute the new IV for each new message
>>
>> 8.If you are requiring that the values be populated by the application –
>>
>> does this require that you have a canonical encoding of how those values
>> are placed into the header for the purposes of the integrity check?
>>
>> Jim
>>
>>
>>
>> ______________________________**_________________
>> jose mailing list
>> jose@ietf.org
>> https://www.ietf.org/mailman/**listinfo/jose<https://www.ietf.org/mailman/listinfo/jose>
>>
>>
> ______________________________**_________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/**listinfo/jose<https://www.ietf.org/mailman/listinfo/jose>
>